GCVE - cpe:2.3:a:tagdiv:tagdiv_composer:*:*:*:*:*:wordpress:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:tagdiv:tagdiv_composer:*:*:*:*:*:wordpress:*:*

part: a version: * update: *

Vendor	Tagdiv (`4e687ca4-50b6-55c5-bb8c-ca6764b542c0`)
Product	Tagdiv Composer (`e32d8f76-dd5e-54cb-b288-25c8516d71be`)
Edition	*
Language	*
Software edition	*
Target software	wordpress
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2025-2806`	vulnerable	2026-06-08 07:16:58.360086	tagDiv Composer <= 5.3 - Reflected Cross-Site Scripting via 'data' MEDIUM (6.1) The tagDiv Composer plugin for WordPress, used by the Newspaper theme, is vulnerable to Reflected Cross-Site Scripting via the ‘data’ parameter in all versions up to, and including, 5.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Published: 2025-05-08T11:23:40.588Z Updated: 2026-04-08T16:52:53.959Z Open on db.gcve.eu Reference links https://www.wordfence.com/threat-intel/vulnerabilities/id/52bd9946-dccc-427a-9abd-0b7153e7484f?source=cve http://localhost:1337/wp-content/plugins/td-composer/legacy/common/wp_booster/td_ajax.php#L2034 https://tagdiv.com/td_deploy/Newspaper/changed_files_12.6.9_12.7.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-5212`	vulnerable	2026-06-08 06:56:15.170036	tagDiv Composer <= 5.0 - Reflected Cross-Site Scripting via envato_code[] MEDIUM (6.1) The tagDiv Composer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘envato_code[]’ parameter in all versions up to, and including, 5.0 due to insufficient input sanitization and output escaping within the on_ajax_register_forum_user function. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Published: 2024-08-31T04:29:19.112Z Updated: 2026-04-08T17:27:37.496Z Open on db.gcve.eu Reference links https://www.wordfence.com/threat-intel/vulnerabilities/id/db95415a-5354-498b-8368-58c47d9948de?source=cve https://tagdiv.com/newspaper/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-3886`	vulnerable	2026-06-08 06:43:51.752494	tagDiv Composer <= 5.0 - Reflected Cross-Site Scripting via envato_code[] MEDIUM (6.1) The tagDiv Composer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘envato_code[]’ parameter in all versions up to, and including, 5.0 due to insufficient input sanitization and output escaping within the on_ajax_check_envato_code function. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Published: 2024-08-31T04:29:19.823Z Updated: 2026-04-08T17:31:39.131Z Open on db.gcve.eu Reference links https://www.wordfence.com/threat-intel/vulnerabilities/id/ed9db9c1-c6b5-459e-9820-ec4ee47b244e?source=cve https://tagdiv.com/newspaper/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-3814`	vulnerable	2026-06-08 06:43:51.589714	tagDiv Composer <= 4.8 - Authenticated (Author+) Stored Cross-Site Scripting via Attachment Meta MEDIUM (5.5) The tagDiv Composer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'single' module in all versions up to, and including, 4.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Published: 2024-06-15T02:01:58.903Z Updated: 2026-04-08T16:51:10.961Z Open on db.gcve.eu Reference links https://www.wordfence.com/threat-intel/vulnerabilities/id/4c2a88c3-5c11-4b42-b8f8-aafecf6c4c74?source=cve https://tagdiv.com/tagdiv-composer-page-builder-basics/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-3813`	vulnerable	2026-06-08 06:43:51.589143	tagDiv Composer <= 4.8 - Authenticated (Contributor+) Local File Inclusion via Shortcode HIGH (8.8) The tagDiv Composer plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.8 via the 'td_block_title' shortcode 'block_template_id' attribute. This makes it possible for authenticated attackers, with contributor-level and above permissions, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where php file type can be uploaded and included. Published: 2024-06-15T02:01:59.965Z Updated: 2026-04-08T17:05:09.543Z Open on db.gcve.eu Reference links https://www.wordfence.com/threat-intel/vulnerabilities/id/87b7bc4a-4d2f-4bcb-a9d5-72e31c95c09e?source=cve https://tagdiv.com/tagdiv-composer-page-builder-basics/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-3170`	vulnerable	2026-06-08 06:09:38.755699	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-3169`	vulnerable	2026-06-08 06:09:38.755149	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-39166`	vulnerable	2026-06-08 06:09:35.848817	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.