CVE-2026-39712

MediumCVSS 5.3

Published: 08/04/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.17%

6th percentile - higher than 6% of all known CVEs

Summary

The tagDiv Composer (td-composer) plugin for WordPress versions up to and including 5.4.3 contains a Basic XSS vulnerability due to improper neutralization of script-related HTML tags, allowing code injection.

Risk Assessment

An attacker can inject malicious JavaScript into the page, potentially leading to session theft, redirects, or actions on the administrator's account.

Recommendation

Update the tagDiv Composer plugin to a version above 5.4.3 as soon as the vendor releases a patch.

Original NVD description (English source)

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in tagDiv tagDiv Composer td-composer allows Code Injection.This issue affects tagDiv Composer: from n/a through <= 5.4.3.