What’s Vulnerable › Products
tagDiv Composer vulnerabilities
20 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 12 published in the last 12 months.
Check whether your tagDiv Composer version is affected
Latest tagDiv Composer vulnerabilities
- CVE-2026-12561 — tagDiv Composer <= 5.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- CVE-2026-57734 — WordPress tagDiv Composer plugin <= 5.4.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- CVE-2026-39712 — WordPress tagDiv Composer plugin <= 5.4.3 - Arbitrary Shortcode Execution vulnerability (CVSS 5.3)
- CVE-2026-39692 — WordPress tagDiv Composer plugin <= 5.4.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- CVE-2025-50001 — WordPress tagDiv Composer plugin <= 5.4.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- CVE-2025-50005 — WordPress tagDiv Composer plugin <= 5.4.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- CVE-2025-62031 — WordPress tagDiv Composer plugin <= 5.4.1 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- CVE-2025-62030 — WordPress tagDiv Composer plugin <= 5.4.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- CVE-2025-2806 — tagDiv Composer <= 5.3 - Reflected Cross-Site Scripting via 'data' (CVSS 6.1)
- CVE-2024-13645 — TagDiv Composer <= 5.3 - Unauthenticated Arbitrary PHP Object Instantiation (CVSS 9.8)
- CVE-2025-1705 — tagDiv Composer <= 5.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting (CVSS 6.1)
- CVE-2025-2804 — tagDiv Composer <= 5.3 - Reflected Cross-Site Scripting via 'account_id' and 'account_username' (CVSS 6.1)
- CVE-2024-5212 — tagDiv Composer <= 5.0 - Reflected Cross-Site Scripting via envato_code[] (CVSS 6.1)
- CVE-2024-3886 — tagDiv Composer <= 5.0 - Reflected Cross-Site Scripting via envato_code[] (CVSS 6.1)
- CVE-2024-3814 — tagDiv Composer <= 4.8 - Authenticated (Author+) Stored Cross-Site Scripting via Attachment Meta (CVSS 4.8)
- CVE-2024-3813 — tagDiv Composer <= 4.8 - Authenticated (Contributor+) Local File Inclusion via Shortcode (CVSS 8.8)
- CVE-2024-3888 — tagDiv Composer <= 4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via button Shortcode (CVSS 6.4)
- CVE-2023-39166 — WordPress tagDiv Composer Plugin < 4.4 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 6.1)
- CVE-2023-3170 — tagDiv Composer < 4.2 - Admin+ Stored XSS (CVSS 4.8)
- CVE-2023-3169 — tagDiv Composer < 4.2 - Unauthenticated Stored XSS (CVSS 6.1)