WordPress tagDiv Composer plugin < 4.0 – Reflected Cross-site Scripting ….

Hi Tagdiv.

I’m on the latest version of the theme “5.3” and running “Version 3.9 | built on 28.02.2023 13:00” of Tagdiv composer. It came with the theme. There’s no updates in the theme-panel. But my site-scan tells me:

“WordPress tagDiv Composer plugin < 4.0 – Reflected Cross-site Scripting vulnerability”.

Is it a false positive – I had this some months ago also, but updated the Tagdiv composer at that point.

Thanks for answering – Will wait 🙂

Any updates on this topic? Newspaper has TD Composer 4.1, so I tried to use that and update TagDiv Composer to 4.1 on Newsmag but the theme is not compatible with 4.1 version. I had to switch back to 3.9 version.

Different sources state that the vulnerability is almost a month old. We need the update asap or at least a disclaimer from tagDiv about how to prevent getting targeted by this attack.

As far as I can tell, we should not click any URL if it has td_video_url parameter in it. Is this correct?

References;
https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/td-composer/tagdiv-composer-40-reflected-cross-site-scripting-via-td-video-url
https://wpscan.com/vulnerability/cada9be9-522a-4ce8-847d-c8fff2ddcc07
https://patchstack.com/database/vulnerability/td-composer/wordpress-tagdiv-composer-plugin-4-0-reflected-cross-site-scripting-vulnerability?_a_id=350

Any news – It was promised last week