WordSec
WordSec

tagDiv Composer

Explore tagDiv Composer vulnerabilities across all versions. Currently tracking 22 known vulnerabilities, including severity, impact, and patch status.

01234567891024.10.2022Today24.10.20229.8tagDiv Composer < 3.5 - Unauthorized Account Access and Privilege Escalation CVSS 9.8 · 24.10.202217.04.20236.1tagDiv Composer < 4.0 - Reflected Cross-Site Scripting via ‘td_video_url’ CVSS 6.1 · 17.04.202325.07.20236.1tagDiv Composer < 4.4 - Cross-Site Request Forgery to Cross-Site Scripting CVSS 6.1 · 25.07.202317.08.20237.2tagDiv Composer <= 4.1 - Unauthenticated Stored Cross-Site Scripting CVSS 7.2 · 17.08.20234.4tagDiv Composer <= 4.1 - Authenticated (Admin+) Stored Cross-Site Scripting CVSS 4.4 · 17.08.202318.04.20245.5tagDiv Composer <= 4.8 - Authenticated (Author+) Stored Cross-Site Scripting via Attachment Meta CVSS 5.5 · 18.04.20248.8tagDiv Composer <= 4.8 - Authenticated (Contributor+) Local File Inclusion via Shortcode CVSS 8.8 · 18.04.202403.06.20246.4tagDiv Composer <= 4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via button Shortcode CVSS 6.4 · 03.06.202430.08.20246.1tagDiv Composer <= 5.0 - Reflected Cross-Site Scripting via envato_code[] CVSS 6.1 · 30.08.20246.1tagDiv Composer <= 5.0 - Reflected Cross-Site Scripting via envato_code[] CVSS 6.1 · 30.08.202427.03.20256.1tagDiv Composer <= 5.3 - Reflected Cross-Site Scripting via 'account_id' and 'account_username' CVSS 6.1 · 27.03.20256.1tagDiv Composer <= 5.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting CVSS 6.1 · 27.03.202503.04.20259.8TagDiv Composer <= 5.3 - Unauthenticated Arbitrary PHP Object Instantiation CVSS 9.8 · 03.04.202501.05.20256.4tagDiv Composer <= 5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes CVSS 6.4 · 01.05.202507.05.20256.1tagDiv Composer <= 5.3 - Reflected Cross-Site Scripting via 'data' CVSS 6.1 · 07.05.202509.10.20257.2tagDiv Composer <= 5.4.1 - Unauthenticated Stored Cross-Site Scripting CVSS 7.2 · 09.10.202516.10.20256.4tagDiv Composer <= 5.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting CVSS 6.4 · 16.10.202508.01.20266.4tagDiv Composer <= 5.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting CVSS 6.4 · 08.01.202624.02.20266.4tagDiv Composer <= 5.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting CVSS 6.4 · 24.02.202602.03.20266.5tagDiv Composer <= 5.4.4 - Unauthenticated Arbitrary Shortcode Execution CVSS 6.5 · 02.03.202610.03.20266.1tagDiv Composer <= 5.4.2 - Reflected Cross-Site Scripting CVSS 6.1 · 10.03.202606.07.20266.1tagDiv Composer <= 5.4.5 - Reflected Cross-Site Scripting CVSS 6.1 · 06.07.2026

Strategic Overview

Avg CVSSMedium
6.6/ 10
Patch Coverage100%
Open

0

Fixed

22

Get automatic notifications for all tagDiv Composer vulnerabilities before they are exploited.

Vulnerability Records

22 records
2026-07-06 00:00
tagDiv Composer <= 5.4.5 - Reflected Cross-Site Scripting
tagDiv Composer
<= 5.4.5
CVE-2026-57734
6.1
Medium
BondsYes
2026-03-10 00:00
tagDiv Composer <= 5.4.2 - Reflected Cross-Site Scripting
tagDiv Composer
<= 5.4.2
CVE-2025-50001
6.1
Medium
João Pedro Soares de AlcântaraYes
2026-03-02 00:00
tagDiv Composer <= 5.4.4 - Unauthenticated Arbitrary Shortcode Execution
tagDiv Composer
<= 5.4.4
CVE-2026-39712
6.5
Medium
BondsYes
2026-02-24 00:00
tagDiv Composer <= 5.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
tagDiv Composer
<= 5.4.4
CVE-2026-39692
6.4
Medium
João Pedro Soares de AlcântaraYes
2026-01-08 00:00
tagDiv Composer <= 5.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
tagDiv Composer
<= 5.4.2
CVE-2025-50005
6.4
Medium
João Pedro Soares de AlcântaraYes
2025-10-16 00:00
tagDiv Composer <= 5.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
tagDiv Composer
<= 5.4.1
CVE-2025-62030
6.4
Medium
João Pedro Soares de AlcântaraYes
2025-10-09 00:00
tagDiv Composer <= 5.4.1 - Unauthenticated Stored Cross-Site Scripting
tagDiv Composer
<= 5.4.1
CVE-2025-62031
7.2
High
João Pedro Soares de AlcântaraYes
2025-05-07 00:00
tagDiv Composer <= 5.3 - Reflected Cross-Site Scripting via 'data'
tagDiv Composer
<= 5.3
CVE-2025-2806
6.1
Medium
Truoc PhanYes
2025-05-01 14:50
tagDiv Composer <= 5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes
tagDiv Composer
<= 5.4
CVE-2025-3510
6.4
Medium
stealthcopterYes
2025-04-03 16:22
TagDiv Composer <= 5.3 - Unauthenticated Arbitrary PHP Object Instantiation
tagDiv Composer
<= 5.3
CVE-2024-13645
9.8
Critical
mikemyersYes
Showing 1–10 of 22 reports

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C