The Plugin “tagDiv Composer” has a security vulnerability.

Posted in: Newspaper
Post count: 4
whitedd
#539844
Feb 11, 2026 at 7:31 am

Wordfence… Critical

https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/td-composer/tagdiv-composer-542-authenticated-contributor-stored-cross-site-scripting

Post count: 4
whitedd
#539845
Feb 11, 2026 at 7:32 am

The tagDiv Composer plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 5.4.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Post count: 35449
Calin
#539853
Feb 11, 2026 at 9:04 am

Hi,
That security vulnerability was fixed, just make sure that you are using the latest theme version, Newsapper v12.7.4, with tagDiv Composer version 5.4.3 – https://patchstack.com/database/Wordpress/Plugin/td-composer/vulnerability/wordpress-tagdiv-composer-plugin-5-4-2-cross-site-scripting-xss-vulnerability?_s_id=cve
https://forum.tagdiv.com/how-to-update-the-theme-2/
Thank you!

Viewing 3 posts - 1 through 3 (of 3 total)
The forum ‘Newspaper’ is closed to new topics and replies.