Cross-site Scripting Vulnerability in tagDiv Composer by tagDiv
CVE-2025-50005

6.1MEDIUM

Key Information:

Vendor

WordPress
Status
Tagdiv Composer
Vendor
CVE Published:
22 January 2026

What is CVE-2025-50005?

A Cross-site Scripting (XSS) vulnerability exists in tagDiv Composer, where improper neutralization of user input during web page generation permits DOM-based XSS attacks. This flaw can potentially enable malicious users to inject arbitrary JavaScript code into web pages viewed by other users, leading to unauthorized actions and data theft. The vulnerability affects versions of the tagDiv Composer plugin up to and including 5.4.2, emphasizing the importance of keeping WordPress plugins updated to mitigate security risks.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

tagDiv Composer <= n/a

References

https://patchstack.com/database/Wordpress/Plugin/td-compo...
vdb-entry

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

João Pedro S Alcântara (Kinorth) | Patchstack Bug Bounty Program
JSON
.