CVE-2023-3169: tagDiv Composer < 4.2 - Unauthenticated Stored XSS

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2023-09-11 · updated 2026-06-17

Description

The tagDiv Composer WordPress plugin before 4.2, used as a companion by the Newspaper and Newsmag themes from tagDiv, does not have authorisation in a REST route and does not validate as well as escape some parameters when outputting them back, which could allow unauthenticated users to perform Stored Cross-Site Scripting attacks.

Affected products

tagDiv Composer: before 4.2 — fixed in 4.2

How to fix

Upgrade to a fixed version: tagDiv Composer 4.2. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/e6d8216d-ace4-48ba-afca-74da0dc5abb5
https://wpscan.com/vulnerability/e6d8216d-ace4-48ba-afca-74da0dc5abb5

Get alerted when CVE-2023-3169 or the next vulnerability affects your stack