How should I solve it, reinstall it?
Hello tagDiv team,
I’m contacting you regarding a serious security issue I’ve been investigating on a WordPress website using the tagDiv Composer plugin.
After noticing a large number of fake user registrations, I performed a full audit of the system, including blocking the REST API, disabling XML-RPC, and adding multiple CAPTCHA layers (Cloudflare Turnstile + image CAPTCHA).
Despite all these protections, fake users were still being created automatically.
🔍 Findings
After enabling detailed logging on the user_register hook, I discovered that all unauthorized user creations originate from this file:
/wp-content/plugins/td-composer/legacy/common/wp_booster/td_ajax.php
The log entries clearly show that the wp_insert_user() call (or an equivalent function) is being triggered from inside that file, even when public registration is disabled in WordPress.
I verified that:
The file path is valid and part of tagDiv Composer.
tagDiv Composer PLUGIN Version 5.4.1 | built on 29.04.2025 10:27
The site is running the latest version of tagDiv Composer and the Newspaper theme.
After reinstalling a fresh copy of the plugin, the issue still persists (which suggests either a persistent injection or an unprotected AJAX endpoint).
THX
RAINA
Email Body:
Hello TagDiv Support Team,
I’m currently using the Newsmag 5 theme for my website MahakalTimes.com
, and I’d like to display a Google Web Stories section just below the Hero Area on the homepage.
I’ve installed and configured the Web Stories plugin by Google, which provides the [web_stories] shortcode. However, I don’t see any built-in option in TagDiv Composer or the homepage template to insert this shortcode directly below the Hero section.
Could you please guide me on the following points:
How can I manually insert the [web_stories] shortcode below the Hero Area using code (PHP or a custom module)?
Which template or PHP file (for example, template-homepage.php, loop.php, or any Hero module file) should I edit to safely add this shortcode below the Hero layout?
Do you have any recommended method or sample code to integrate plugin shortcodes like [web_stories] inside the homepage structure without affecting theme updates?
My goal is to feature a Web Stories showcase (horizontal scroll or grid style) immediately under the Hero section, maintaining full visual alignment with the theme’s layout.
Thank you for your time and support.
Best regards,
Umesh Sharma
Editor – MahakalTimes.com
Hello tagDiv Support Team,
We have encountered the same issue described here.
On our Russian version of the website (using the Newspaper theme), everything works correctly — all standard social share icons (Facebook, Twitter (X), LinkedIn, Pinterest, WhatsApp, Telegram, etc.) are visible and configurable under Theme Panel → Social Share.
However, on our Kazakh version of the website — which uses the exact same Newspaper theme version and identical configuration — only uncommon networks appear (Naver, Kakao, Gettr, Koo, Flipboard, etc.), while all major ones are missing.
✅ Both sites use separate WordPress installations and separate databases,
✅ The Newspaper theme version is identical on both,
✅ Cache has been cleared, and settings re-saved multiple times.
Could you please confirm whether this issue still persists in the latest release, or if there’s a manual fix available before the next update?
Thank you very much for your help!
Best regards,
Eurasia24 Media Team
https://eurasia24.media
Hi,
This situation appears when the theme plugins are not installed/updated. Please go to Newspaper plugins and make sure that the theme plugins you had before the theme update are installed and activated, those should be: tagDiv Composer, tagDiv Cloud Library, in some cases, tagDiv Standard Pack. IN case that there are othere shortcodes appering after you activated those plugins, then please provide some screenshots with them.
Thank you!
Hi,
Please make sure that you have the latest WordPress version and the latest theme version, 12.7.1 and in case that the problem is still the same please install the plugin classic editor, this should resolve the problem https://wordpress.org/plugins/classic-editor/
Thank you!
Hi,
Could you please provide more details, including screenshots and links to the pages that are not working on mobile? Do you use the mobile theme plugin?
For the problem _load_textdomain_just_in_time from td-cloud-library, please download and reinstall the plugin from here -> https://cdn.tagdiv.com/wp-content/uploads/2025/07/td-cloud-library.zip
Thank you!
on mine https://2daydubai.com i just installed a fresh copy, i have no cache handler at all.
Hi,
I just made some tests, and on my install, it seems to work correctly – https://i.imgur.com/1JUaQ3N.png on both mobile and desktop. Maybe something was interfering.
Thank you!
I just installed Newspaper and this is my first experience with the theme.
I want to update Header and I noticed it is using a Cloud template.
When using Cloud templates, I go to Header templates, try to Edit with TD Composer the template “Header Template – Gourmet PRO” and I get page that says:
“Sorry, this page doesn’t exist.
Please check the URL or go back a page.
404 Error. Page Not Found.”
Then I close that and go back to Cloud templates, and click the “+” symbol to see if it will let me add a new template, and it show blank page with “Invalid reply from server endpoint.”
I basically can’t do anything with header. I want to use the Header of the sample website, but add my logo to it. That is all I wanted to do.
What is going on with this theme?
Thanks a lot Simion, I’m not sure what I had done, but I was having an issue and couldn’t access the Setup Wizard screen. Then I uninstalled and reinstalled the Opt-in Builder, and it worked.
Regards
I’ve tried to uninstall the plugin and reinstall again, but I keep seeing the same numbers. Actually, the plugin didn’t even loose the config, so I think that I need to clean the cache.
Can you indicate me how to do it? I’ve been looking up in the documentation but I didn’t find anything.
Cheers.
Hi,
Was the theme modified perhaps? Because there’s no variable like that on that line or anywhere in the theme functions file. Or is that a child theme? If you reinstall the theme, and deactivate the child theme if there is one, are the errors still generated?
Thanks.
Hi,
That’s a very old theme version. However, even if you update the theme the website should look the same.
It is important that you install the standard pack plugin after you update https://prnt.sc/AjDfjpCqFbq_ This plugin we added in Newspaper 10 contains all the old blocks and templates, which are separate from the main theme now. There is an article about it here https://tagdiv.com/newspaper-theme-update-standard-pack-or-tagdiv-cloud-templates/
Be sure to also clear the cache, or the optimized resources, or cloudflare if you use it, after updating the theme.
If you use a child theme I suggest deactivating it after updating, as it could cause problems.
And maybe it would be best to try updating on a staging/testing clone of the website first, if possible. If you have a staging already, I could take a look there as well, you can send the access details and link to contact@tagdiv.com
Thanks.
Hi,
The theme is very easy to install.
The first step is the installation itself
https://forum.tagdiv.com/install-via-wordpress/
The second step is activating the theme with the license key https://forum.tagdiv.com/newspaper-6-how-to-activate-the-theme/
The third step is to install a theme demo
https://forum.tagdiv.com/installing-demos/
Then it’s a matter of learning how to use the theme while customizing the demo.
If you need help with either of these steps, we will provide assistance. You can send us an email at contact@tagdiv.com and provide a link to your website and admin login (user and pass). Then we will log in and help directly on the website.
Let us know at any time.
Thanks.
Hi,
Actually we had a few other reports concerning this file wp-content/plugins/td-composer/legacy/common/common.php
Its a security module called CPGuard which flags a part of the code from that file from the composer. It’s a false positive however, we checked those cases and the code in the file was as it should be. The solution was to whitelist the file or path https://opsshield.com/help/cpguard/whitelist-files/ We will however check more to see if we can modify the code in the file so it doesn’t trigger security rules.
I’m not sure about WPBakery however. You could install the latest version for it https://cdn.tagdiv.com/wp-content/uploads/2025/10/js-composer-8.6.1.zip Seems they made security improvements in a recent update https://kb.wpbakery.com/docs/preface/release-notes/
Thanks.
Hi,
We’re still working on a few more fixes we would like to include in the update.
The fix for the issue with editors not being able to use the composer is included in the next update. In the meantime please use this composer version which contains the fix https://cdn.tagdiv.com/wp-content/uploads/2025/05/td-composer.zip The problem should be solved after installing it.
We are very sorry for this situation and inconvenience. Hopefully next week an update will be released.
Thanks.
Because of your late reply, I have delete my newspaper theme and reinstalled it, that’s why it’s fine right now. If I have same issues in future i will contact you
Hi,
Only one demo can be installed at a time. Previewing demos can be done on our live demos https://demo.tagdiv.com/select_demo/newspaper-prebuilt-websites/?demo-type=all An installed demo will look like the live demos.
Or you could install the theme on a staging/testing website or local install, and test there.
Or you could import what you need from the cloud library, most of the homepages and templates are available there separately https://prnt.sc/m3Xvzh0DiM_a
Please take into account what uninstalling a demo or installing a new demo means. Everything that the old demo imported will be removed, and the theme panel will be reset.
Thanks.
Hi,
Normally a PHP info file should be created and used just when needed, and after its not needed it should be deleted. I see you still have it https://www.cidademarketing.com.br/marketing/info.php Please remove it, the file is in the wordpress folder, you can use any file manager to do it.
A backup will be large if the website is large. It contains all the website files and the database. You can use other backup methods or dedicated plugins but the size will be about the same. A duplicator package however can be installed on the same website or on a new server quite easily. You just upload the package and install it manually in case the website cannot be accessed anymore https://duplicator.com/knowledge-base/classic-install/ If the website can be accessed then you can restore it through the duplicator plugin panel.
Thanks.
hi this is my website where i installed newspaper – https://midnightblue-wren-996070.hostingersite.com/
i was able to change the logo on desktop header but didn’t found a way to do same in mobile header, please help me
I’m very grateful for everyone’s tips.
Simon, could you send me the link to the WP Rocket plugin? I did some research and found several with the same name. I’ll consult with our infrastructure team to see if the new server will perform better than the one we’re using. If it’s the same, I think it’s not worth it—as the saying goes here in Brazil—”swapping six for half a dozen.” I’ll install an optimization plugin to evaluate it. We’re also testing removing popups and Google Adsense, which consume a lot during the initial site access process. Thanks! Hugs,
Hi,
Installing and using the theme is very simple. After you install the theme and activate the composer plugin https://prnt.sc/ZseUA9EF-tVy the theme panel will show up like this https://prnt.sc/1g4ODxkX4mEp Those are all the theme settings.
I’m not sure what option you are seeing for upgrading to pro. There’s no pro version of the theme.
If there is a problem with the theme on your website then we will check directly on your website. Please send us an email at contact@tagdiv.com and provide a link to the website and admin login (user and pass). We will check as soon as possible.
Thanks.
Ok for anyone encountering this issue, i have WP Rocket. The issue is, WP Rocket still had an archive of template in memory. I had to install “WP Rocket | Customize Mobile Cache options” AND clear my CDN to be able to see my website like i’ve configured it through tagDiv
