Search Results for 'td composer'

Results from the Forum
Simion C.
tagDiv Staff

Hi,

Normally no modifications are needed. The theme deletes the transients automatically (via wp cron), the code is in this file -> wp-content\plugins\td-composer\legacy\common\wp_booster\td_transients_manager.php This functionality was already in the code since the block cache was added as a feature. If they would not get cleared, then the database would indeed increase.

If they aren’t getting deleted on your website, maybe it’s a conflict, perhaps with a caching/optimization plugin. Or the wordpress cron is disabled. It’s not something that we can recreate or something that was reported by multiple theme users.

Thank you!

Simion C.
tagDiv Staff

Hi,

The tables you mentioned belong to the theme.

The td_011 table is where the theme panel settings are kept, as well as other data from the composer. I suggest not removing or emptying that table, because it will basically reset the theme panel.

The td_011_settings is where the theme keeps backups of the theme panel. The settings are here -> https://prnt.sc/1M-xnh3_qjbl These backups are optional, but they are active by default because it can be useful sometimes. To reduce the size of this table you could reduce the number of backups -> https://prnt.sc/KE9mnFCxvpyu Or disable the option entirely, and the data will be removed.

Thank you!

trebol30
Participant
#0

Hello,

Since August 1, I have noticed that the WordPress administration panel has been responding more slowly than usual.

I have reviewed several possible causes and found that WordPress is currently reporting a critical Site Health issue related to autoloaded options.

Current data reported by WordPress:

– 1,326 autoloaded options.
– Approximate size shown by Site Health: 2 MB.
– WordPress indicates that this volume could affect performance.

I also checked the options table directly in the database. The current autoloaded volume is approximately:

– autoload = yes: 1.54 MB
– autoload = auto: 0.12 MB
– autoload = on: 0.11 MB

Approximate total loaded automatically: 1.77 MB.

The total number also matches the 1,326 options reported by Site Health:

– yes: 1,131 options
– auto: 164 options
– on: 31 options
– total: 1,326 options

The largest individual options related to Newspaper/TagDiv are:

– td_011_settings: 820.24 KB — autoload yes
– td_011: 164.02 KB — autoload yes
– td_011_remote_cache: 35.64 KB — autoload yes
– td_011_log: 8.18 KB — autoload yes

The td_011_settings and td_011 options alone total approximately 984 KB. Therefore, these two options currently represent more than half of all the data WordPress loads automatically.

As an additional check, I also found a residual option from an old plugin:

– wpts_compat: 287.02 KB — autoload yes

Using WP-CLI, I confirmed that it belonged to a previous WPtouch installation:

– Original serialized class: WPtouchDefaultSettingsCompat
– WPtouch is no longer installed.
– There is no active or inactive WPtouch plugin or WPtouch folder on the server.

I did not delete the option. I only changed its autoload value from yes to off in a fully reversible way.

After making this change:

– The total autoloaded size decreased from approximately 2.05 MB to 1.77 MB.
– The autoload = yes group decreased from 1.82 MB to 1.54 MB.
– The administration panel appears to respond slightly faster, although I cannot confirm with complete certainty that the improvement is exclusively related to this change.
– Site Health still reports a critical issue related to autoloaded options.

I have also reviewed other possible causes of the slow administration panel.

1. Action Scheduler

The active Action Scheduler table appears to be working normally:

– No actions are currently in progress.
– Only three actions are pending, and all of them are scheduled for future dates.
– There have been no new failed actions since August 1.
– There is no active backlog of blocked or repeatedly failing jobs.

2. WP-Cron

The WordPress cron option is approximately 12.28 KB, so it does not appear unusually large.

3. WP Rocket RUCSS and background processes

There are periodic checks related to WP Rocket SaaS jobs, but the actions are completed successfully and do not accumulate. There does not appear to be a blocked queue that would independently explain the continued wp-admin slowdown.

Therefore, I cannot confirm that Newspaper options are the only cause of the problem, but they currently represent the main remaining portion of the autoloaded data.

I would like you to review the following questions specifically:

1. Is it normal for td_011_settings to exceed 820 KB?

2. Do td_011_settings and td_011 need to remain autoloaded on every WordPress request, including wp-admin requests?

3. Is it safe to change the autoload value of either of these options to off, or does Newspaper require them during almost every request?

4. Does Newspaper provide an official process for cleaning, rebuilding, or reducing td_011_settings and removing old configuration data that is no longer used?

5. Could td_011_settings contain accumulated data from Cloud Templates, the Theme Panel, blocks, advertisements, headers, footers, or old configurations that are no longer active?

6. Is there a diagnostic tool or recommended method to identify which internal settings are responsible for the 820 KB stored in td_011_settings?

7. Would it be possible to split this option into several smaller options and avoid autoloading data that is only required on specific screens?

8. Has there been any recent change in Newspaper or TagDiv Composer that could have increased the size of these options or the amount of processing performed inside wp-admin?

I have not modified or deleted any Newspaper-related option. Before changing their autoload values or altering their contents, I need confirmation from your team regarding which options must remain autoloaded and what official procedure you recommend to reduce their size without affecting the theme or the Cloud Templates.

Thank you.

Simion C.
tagDiv Staff

Hi,

As far as I know all known vulnerabilities have been fixed for the composer -> https://patchstack.com/database/wordpress/plugin/td-composer/vulnerabilities

In the last update there were fixes for the composer, cloud library, opt-in builder -> https://tagdiv.com/newspaper-changelog/ I don’t think there are more at this time. Please update the theme.

Thank you!

Atyllo
Participant
#0

Hello,

I’m using Newspaper 12.7.7 with the latest tagDiv Composer.

My homepage scores around 60 on Google PageSpeed Insights (mobile).

Lighthouse identifies the homepage LCP element as:

<span class=”entry-thumb td-thumb-css”
style=”background-image:url(…)”>

The image is rendered as a CSS background instead of an element.

Lighthouse reports:

fetchpriority=high should be applied
render-blocking CSS, especially:
td_legacy_main.css
style.css
tds-front.css

I already tested:

latest Newspaper and tagDiv Composer versions
Jetpack Image Accelerator enabled
cache enabled
manually adding a preload for the LCP image

My questions are:

Is there any supported setting or Flex Block that renders the featured image as a real instead of a CSS background?
Is there an official hook/filter to customize the thumbnail markup?
Is there a recommended way to improve LCP for Newspaper homepages?
Can td_legacy_main.css or other legacy CSS resources be safely disabled on Newspaper 12.7.7?

Website:
https://actugeekgaming.com
PageSpeed test :
https://pagespeed.web.dev/analysis/https-actugeekgaming-com/hodhlqczsz?form_factor=mobile

Thank you!

mattemkadia
Participant
#0

Hi guys, I’d like to use custom default images on my website, so I’ve created the image path in my child theme, but it doesn’t seem to work.

By default, if no featured image is set, it will use default images from the following path.

/wp-content/plugins/td-composer/legacy/Newspaper/assets/images/no-thumb/td_1920x0.png

I’ve uploaded my own custom images to the following path, but they’re not working.

/wp-content/themes/child-theme/Newspaper-child/td-composer/legacy/Newspaper/assets/images/no-thumb/td_1920x0.png

What am I missing?
Thanks
Matt

Simion C.
tagDiv Staff

In the meantime I’ve got confirmation from Wordfence and WPScan that they acknowledged the issue was fixed:

https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/td-composer/tagdiv-composer-545-reflected-cross-site-scripting

https://wpscan.com/vulnerability/601ad8e7-0ebf-4726-bfcf-b27b9d109137/

Maybe your website has been infected with malware. Updating the theme won’t fix it. Please test the website with the Sucuri live scanner -> https://sitecheck.sucuri.net/

If it detects malware, then I strongly recommend to immediately install the Wordfence plugin -> https://wordpress.org/plugins/wordfence/ and scan the website with it as soon as possible -> https://www.wordfence.com/help/scan/ if you haven’t already.

Could you provide a link to the website?

Simion C.
tagDiv Staff

Wordfence should mark it as fixed soon. The issue affected the composer from the Newspaper theme, which was fixed -> https://patchstack.com/database/wordpress/plugin/td-composer/vulnerability/wordpress-tagdiv-composer-plugin-5-4-3-reflected-cross-site-scripting-xss-vulnerability

Today a new update was released for Newsmag -> https://tagdiv.com/newsmag/ The composer is now version 5.4.6. Please update the theme and it will be fine.

crazydrake
Participant
#0

Hi – Our host flagged this for us. Can you review and let us know what we need to do fix?

Beyond this we are picking up on heavy search queries that work around the plugin td-composer. The specific file triggered is:

wp-content/plugins/td-composer/legacy/common/wp_booster/td_data_source.php line 1517

The site is spawning quite a few of them, and it’s the main contributor to the high load:

==============================================================================================================
Host:     barrettmedia.com
Request:  /page/2/?s=cbs+evening+news
Remote:   17.246.23.246
UA:       Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4 Safari/605.1.15 (Applebot/0.1; +http://www.apple.com/go/applebot)
Started:  2026-07-21T21:18:39.878639Z
SQL:      SELECT SQL_CALC_FOUND_ROWS  wp_posts.ID  FROM wp_posts   WHERE 1=1  AND wp_posts.ID NOT IN (237966) AND (((wp_posts.post_title LIKE '%cbs%') OR (wp_posts.post_excerpt LIKE '%cbs%') OR (wp_posts.post_content LIKE '%cbs%')) AND ((wp_posts.post_title LIKE '%evening%') OR (wp_posts.post_excerpt LIKE '%evening%') OR (wp_posts.post_content LIKE '%evening%')) AND ((wp_posts.post_title LIKE '%news%') OR (wp_posts.post_excerpt LIKE '%news%') OR (wp_posts.post_content LIKE '%news%')))  AND (wp_posts.post_password = '')  AND wp_posts.post_type IN ('post', 'page', 'attachment', 'job_listing', 'tdc-review') AND ((wp_posts.post_status = 'publish')) OR EXISTS (                                 SELECT 1 FROM wp_term_relationships AS tr                                 INNER JOIN wp_term_taxonomy AS tt ON tr.term_taxonomy_id = tt.term_taxonomy_id                                 INNER JOIN wp_terms AS t ON tt.term_id = t.term_id                                 WHERE tr.object_id = wp_posts.ID                                 AND tt.taxonomy = 'category'                                 AND ( t.name LIKE '%cbs evening news%' OR tt.description LIKE '%cbs evening news%' )                                 AND wp_posts.post_status = 'publish'                                                              ) OR EXISTS (                                 SELECT 1 FROM wp_term_relationships AS tr                                 INNER JOIN wp_term_taxonomy AS tt ON tr.term_taxonomy_id = tt.term_taxonomy_id                                 INNER JOIN wp_terms AS t ON tt.term_id = t.term_id                                 WHERE tr.object_id = wp_posts.ID                                 AND tt.taxonomy = 'post_tag'                                 AND ( t.name LIKE '%cbs evening news%' OR tt.description LIKE '%cbs evening news%' )                                 AND wp_posts.post_status = 'publish'                                                              ) OR EXISTS (                                 SELECT 1 FROM wp_term_relationships AS tr                                 INNER JOIN wp_term_taxonomy AS tt ON tr.term_taxonomy_id = tt.term_taxonomy_id                                 INNER JOIN wp_terms AS t ON tt.term_id = t.term_id                                 WHERE tr.object_id = wp_posts.ID                                 AND tt.taxonomy = 'tdc-review-criteria'                                 AND ( t.name LIKE '%cbs evening news%' OR tt.description LIKE '%cbs evening news%' )                                 AND wp_posts.post_status = 'publish'                                                              )  GROUP BY wp_posts.ID  ORDER BY (CASE WHEN wp_posts.post_title LIKE '%cbs evening news%' THEN 1 WHEN wp_posts.post_title LIKE '%cbs%' AND wp_posts.post_title LIKE '%evening%' AND wp_posts.post_title LIKE '%news%' THEN 2 WHEN wp_posts.post_title LIKE '%cbs%' OR wp_posts.post_title LIKE '%evening%' OR wp_posts.post_title LIKE '%news%' THEN 3 WHEN wp_posts.post_excerpt LIKE '%cbs evening news%' THEN 4 WHEN wp_posts.post_content LIKE '%cbs evening news%' THEN 5 ELSE 6 END), wp_posts.post_date DESC  LIMIT 0, 5
Origin:   plugin | td-composer | wp-content/plugins/td-composer/legacy/common/wp_booster/td_data_source.php:1517
Duration: 3.698309 s
Memory:   42.00 MB (peak 42.00 MB)

Such queries, taking around 4 seconds to be completed, will slow the entire site, so I’d recommend revisiting the code around that function

ferhatakbas
tagDiv Member

I saw the recent message stating that a fix for the td-composer vulnerability (v5.4.5) will be released “this week.”

Could you please provide an exact ETA for this update? My website’s files are being constantly modified and infected by attackers every single day because of this exploit. Dealing with this exact same hacking issue and restoring backups daily is becoming a massive problem for us.

We urgently need this security patch to secure our systems. Thank you.

Simion C.
tagDiv Staff

Hi,

It’s a false positive most likely. I’ve downloaded the theme package from themeforest and scanned the composer with virus total, it’s in order -> https://prnt.sc/4iIOjqaTh7AZ I also scanned it locally with Bitdefender, it’s also in order. So it’s safe to say that the composer as provided in the theme package poses no threat.

Maybe the website itself is infected with malware. To know for sure you could test your website with this online scanner from Sucuri -> https://sitecheck.sucuri.net/ Or install the Wordfence plugin and scan the website files with it.

Thank you!

metallikos
tagDiv Member

I fixed it by adding this in the file: wp-content/plugins/td-composer/legacy/common/wp_booster/wp-admin/external/wpalchemy/MetaBox.php (line 576).

Fix:
add_meta_box($this->id . ‘_metabox’, $this->title, array($this, ‘_setup’), $type, $this->context, $this->priority, array(
‘__block_editor_compatible_meta_box’ => true,
‘__back_compat_meta_box’ => false,
));

I am writing my own version of the theme to wean off third parties.

JayWay
Participant
#0

I’ve installed Newsmag. The version i have on my site is : 5.4.3.6. If i try to update, it won’t.
How come the problem is stated as version 5.4.5?
This is a warning that comes up in Worfence : https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/td-composer/tagdiv-composer-545-reflected-cross-site-scripting

As the problem is present since July 6, 2026, with a last update with no change on July 16, 2026, i am wondering when you’re going to address this problem.

costinr
Participant
#0

Hi,

Wordfence signaled today about this: tagDiv Composer Version: 5.4.5 has a security vulnerability.
Details here:
https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/td-composer/tagdiv-composer-545-reflected-cross-site-scripting

Here is the alert:
https://www.pasteboard.co/9HSozTwjG8pN.png

Please advice,
Thank you,

mawo
Participant
#0

hi, i had this message in my wordpress:

tagDiv Composer has a known vulnerability that may be affecting your installed version.

Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in tagDiv tagDiv Composer td-composer allows Reflected XSS.This issue affects tagDiv Composer: from n/a through <= 5.4.3.
Esta vulnerabilidad no parece tener parche. Presta atención a las próximas actualizaciones del plugin.

WomenInStunts
tagDiv Member

tagDiv Composer <= 5.4.5 – Reflected Cross-Site Scripting

The tagDiv Composer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 5.4.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/td-composer/tagdiv-composer-545-reflected-cross-site-scripting

Ephistos
Participant
#0

Hello,

I am getting repeated PHP warnings inside TagDiv Composer:


Warning: Undefined array key "location" in
/wp-content/plugins/td-cloud-library/includes/tdb_config.php
on line 63782

The warnings appear across the Composer interface and make it difficult to edit my templates. I am also unable to save changes in TagDiv Composer.

Could you please advise what could cause this and how to fix it? Could it be a compatibility issue between my PHP version, Newspaper theme, TagDiv Composer, and TagDiv Cloud Library?

I have attached a screenshot. Thank you for your help.

error

If the img doesn’t appear : https://ibb.co/vxyNVKS3

Simion C.
tagDiv Staff

Hi,

There’s no such sorting method unfortunately.

You could modify the 7 days filter, it’s in this file -> wp-content\plugins\td-composer\legacy\common\wp_booster\td_data_source.php

If you search in that file there will be a section like this -> https://prnt.sc/uOluDxQiHdJj
Then change the “1 week ago” to for example “30 days ago”. I believe it should work, the block should then display random posts from the last 30 days.

I’m sorry for the inconvenience.

Thank you!

cuongdo.news
Participant
#0

After updating our website from the previous WordPress version to WordPress 7.0.1, we encountered several critical issues with the Newspaper theme.

Environment
Theme: Newspaper
WordPress: 7.0.1
PHP: (please fill in your PHP version)
Website: https://suckhoemoi.com
Issues
Frontend displays raw shortcode/JSON instead of rendering the page properly.
Pages show raw tagDiv content instead of the designed layout.

Gutenberg editor reports:

“This block has encountered an error and cannot be previewed.”

Eventually, the entire WordPress admin became inaccessible with a “There has been a critical error on this website” message.
Troubleshooting

We investigated the issue and found that the problem is caused by td-composer.

Renaming the td-composer plugin folder immediately restored access to the WordPress admin.
After disabling td-composer, the critical error disappeared.
This strongly suggests that the current version of td-composer is not compatible with WordPress 7.0.1.
Expected behavior

The Newspaper theme and td-composer should work correctly with WordPress 7.0.1 without causing:

Critical PHP errors
Gutenberg block errors
Frontend rendering issues

Could you please confirm:

Is WordPress 7.0.1 officially supported?
Is there an updated version of td-composer compatible with WordPress 7.0.1?
If not, when will a compatible update be released?

Thank you for your support.

Best regards.

Simion C.
tagDiv Staff

Hi,

I see there was some work done on the review section a while ago in a previous update. The reason was to fix the case when using the points review type, when users were adding commas instead of periods in the values -> https://prnt.sc/zv18e5RW2iYU This lead to calculation problems for the review.

The fix was to automatically transform the commas to periods, intended just for that points input field specifically. But it seems to apply to all the inputs, including the feature name.

I could provide a quickfix for this issue. Please download this file from here -> https://cdn.tagdiv.com/wp-content/uploads/2026/07/td_set_post_settings.zip

Unzip it and there will be a PHP file. That file must replace the existing file via this path in the composer -> wp-content\plugins\td-composer\legacy\common\wp_booster\wp-admin\content-metaboxes

If you want I can do it on your website, and I’ll also test to see if the issue is solved. You can send us an email at contact@tagdiv.com and provide a link to the website, admin user and pass, also access to cPanel or FTP.

We are very sorry for this inconvenience.

Thank you!

boutiquepcland
Participant
#0

Hello, I received a notification regarding the “WordPress tagDiv Composer plugin <= 5.4.3 – Reflected Cross-Site Scripting (XSS) vulnerability (CVE-2026-57734).” I can’t dismiss the notification, but is a fix expected? I also have this link: https://patchstack.com/database/wordpress/plugin/td-composer/vulnerability/wordpress-tagdiv-composer-plugin-5-4-3-reflected-cross-site-scripting-xss-vulnerability

#0

Hi there!

Confirmed TagDiv Composer serialization drift (tdc_content out of sync with post_content) – supported recovery procedure?

We have isolated what appears to be a TagDiv Composer synchronization problem on our homepage and would like to know the supported recovery procedure.

We are not asking for general troubleshooting. We believe we have already identified the root cause and would like confirmation of the proper recovery method.

Environment
Newspaper Theme
TagDiv Composer
WordPress
Staging site
Homepage

The frontend renders correctly.

The homepage content is intact.

Only TagDiv Composer cannot load the page correctly.

Composer displays:

Layout sync error in Content, row 1. The editor expects 1 element but the page is rendering 5.

Investigation

We performed a read-only investigation and found:

post_id: 338024

tdc_dirty_content

1

tdc_content

[tdc_zone type=”tdc_content”][vc_row][vc_column][/vc_column][/vc_row][/tdc_zone]

The stored post_content contains the complete homepage layout with five vc_row_inner sections, while tdc_content contains only the minimal empty scaffold.

The frontend renders correctly because post_content is intact.

Composer appears to be comparing:

the serialized editor model (tdc_content)
against the current post_content

and reporting:

“expects 1 element but the page is rendering 5.”

Our question

Is this a known TagDiv Composer synchronization state?

If so, what is the supported method to regenerate or synchronize tdc_content from the existing post_content?

We are specifically looking for the supported recovery procedure.

We are not looking for workarounds such as rebuilding the homepage manually unless that is officially required.

Thanks your for help with this. Please let me know if any other information is required.

https://okobserverorg.staging.wpmudev.host/wp-admin
contact@wpmudev.org
(password sent via email to: contact@wpmudev.org)

Bob

Viewing 25 results - 1 through 25 (of 9,951 total)