CVE-2026-39692

MediumCVSS 6.5

Published: 08/04/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.13%

3th percentile - higher than 3% of all known CVEs

Summary

The tagDiv Composer plugin for WordPress (versions up to and including 5.4.3) contains a Stored Cross-Site Scripting (XSS) vulnerability due to improper input neutralization during page generation. An attacker can inject a malicious script that executes in other users' browsers.

Risk Assessment

An attacker can steal credentials, modify page content, or perform other unauthorized actions, compromising site integrity.

Recommendation

Update the tagDiv Composer plugin to version 5.4.4 or later if available; otherwise, remove or disable the plugin.

Original NVD description (English source)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tagDiv tagDiv Composer td-composer allows Stored XSS.This issue affects tagDiv Composer: from n/a through <= 5.4.3.