tagDiv Composer <= 5.4.5 – Reflected Cross-Site Scripting

Posted in: Newsmag
Post count: 20

I’ve installed Newsmag. The version i have on my site is : 5.4.3.6. If i try to update, it won’t.
How come the problem is stated as version 5.4.5?
This is a warning that comes up in Worfence : https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/td-composer/tagdiv-composer-545-reflected-cross-site-scripting

As the problem is present since July 6, 2026, with a last update with no change on July 16, 2026, i am wondering when you’re going to address this problem.

  • This topic was modified 2 weeks by JayWay.
Post count: 20

Ok, i figured out that the theme with version 5.4.3.6 uses the tagdiv composer plugin version 5.4.5, so that question is answered….

Post count: 20685

Hi,

That issue refers to the composer from the Newspaper theme, it was related to the button element which Newsmag doesn’t have. It was fixed partly in the previous Newspaper update but it needs an adjustment, we will release a new update this week most likely.

Thank you!

Viewing 3 posts - 1 through 3 (of 3 total)
You must be logged in to reply to this topic.