Hi. According to patchstack, there is a vulnerability for tagDiv Composer Plugin <= 5.4.1 (This vulnerability is moderately dangerous and expected to become exploited. CVSS severity 7.1).
I suppose your team is already aware of this security vulnerability.
I am using the last version 5.4.3.3 of Newsmag theme.
When will the updated version be released?
Thank you.
George
Hi,
We are working to a theme update that will fix this vulnerability.
This will be released soon!
Hi Calin, is there any update on the expected launch?
Hi Calin, i also get warnings from my hosting provider about : WordPress tagDiv Composer Plugin <= 5.4.1 is vulnerable to Cross Site Scripting (XSS)
Are there any updates yet?
Ok, i see no progress on this item, i’ll engage Envato support now as this problem is a serious breach of safety and the the topic already started : Oct 24, 2025 at 10:19 am, with no reply or update.
Hi,
Our developers are preparing the update and will release it in the coming days.
Thank you!
Ok, we’ll see. There’s more to this : authenticated Stored Cross-Site Scripting (XSS) AND Reflected XSS…….
The update has been released. Please update the theme to the latest version. The update contains the fix for the respective vulnerability and the composer version has been updated to 5.4.2.
Thank you!
Same problem here
Ah, YES, all ok now….. let’s see the future …..
Themeforest sent out a notice this morning that update is available to download.
Best way to update, is decompress files on local drive; then login via FTP to site, remove old theme, upload new version; remove old plugin for td-composer; upload new version.
Log into panel, activate composer plugin. Check menus and footer.
Always make backup of site prior to update!
Just checked again : seems not to be completely updated still on my site, trying manual update……My thinking : I just bought this plugin from Envato short time ago and it’s problems out of the box ….. I like the theme, really, not the problems……
No problems here.
Thanks for the fair response, i’ll request for a refund please.
The new update should be detected if you press the check for updates button in the theme updates panel. Then the new version can be installed. Or, the theme can be updated manually, like any other wordpress theme. It only takes a few minutes to update the theme using any method.
If anyone has issues updating the theme, please send us an email at contact@tagdiv.com and provide admin login for the website so we can check as well.
@JayWay Sorry to hear that. The update was meant to fix the vulnerability and improve security, not to cause users to request a refund. Please send us an email and let us know what the problems are exactly. Also please provide access to the website so we can investigate. We will gladly take a look. Once the issues are cleared up, we hope that since you like the theme you can continue using it for your website.
Thank you!
Ok, i was maybe a bit too strong in my reaction. I’ve reinstalled the complete website and installed the theme, warnings are gone. As this site is still in development mode i cannot provide you with these details, however, i start a new topic, because in the new version i’ve comment boxes count shown in SOME pictures of the grids i use…. they all show 0….
Hi,
In case you want to remove the comment box from your blocks you can use the theme panel settings – https://i.imgur.com/JTKWtMn.png
Thank you!
