Tagdiv vulnerabilities
40 vulnerabilities
Known vulnerabilities in Tagdiv products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 7 products.
Products
7- Tagdiv Composer22 vulnerabilities
- Newspaper7 vulnerabilities
- Tagdiv Opt In Builder7 vulnerabilities
- Composer2 vulnerabilities
- Newsmag2 vulnerabilities
- Tagdiv Cloud Library2 vulnerabilities
- Cloud Library1 vulnerabilities
CVE-2021-24304tagdivnewsmag+2
EPSS score1.23%
The Newsmag WordPress theme before 5.0 does not sanitise the td_block_id parameter in its td_ajax_block AJAX action, leading to an unauthenticated Reflected Cross-site Scripting (XSS) vulnerability.CVE-2021-3135tagdivnewspaper+1EPSS score0.83%
An issue was discovered in the tagDiv Newspaper theme 10.3.9.1 for WordPress. It allows XSS via the wp-admin/admin-ajax.php td_block_id parameter in a td_ajax_block API call.CVE-2016-10972tagdivnewspaper+1EPSS score9.27%
The newspaper theme before 6.7.2 for WordPress has a lack of options access control via td_ajax_update_panel.CVE-2025-2806tagdivtagdiv_composer+1EPSS score0.33%
The tagDiv Composer plugin for WordPress, used by the Newspaper theme, is vulnerable to Reflected Cross-Site Scripting via the ‘data’ parameter in all versions up to, and including, 5.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.CVE-2025-2804tagdivtagdiv_composer+1EPSS score0.26%
The tagDiv Composer plugin for WordPress, used by the Newspaper theme, is vulnerable to Reflected Cross-Site Scripting via the 'account_id' and 'account_username' parameters in all versions up to, and including, 5.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.CVE-2025-2890tagdivtagdiv opt-in builder+1EPSS score0.40%
The tagDiv Opt-In Builder plugin for WordPress is vulnerable to time-based SQL Injection via the ‘subscriptionCouponId’ parameter in all versions up to, and including, 1.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.CVE-2025-1705tagdivtagdiv_composer+1EPSS score0.40%
The tagDiv Composer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.3. This is due to missing or incorrect nonce validation within the td_ajax_get_views AJAX action. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.CVE-2025-62032tagdivtagdiv cloud library+1EPSS score0.20%
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tagDiv tagDiv Cloud Library td-cloud-library allows DOM-Based XSS.This issue affects tagDiv Cloud Library: from n/a through < 3.9.2.CVE-2025-62031tagdivtagdiv_composer+1EPSS score0.23%
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tagDiv tagDiv Composer td-composer.This issue affects tagDiv Composer: from n/a through <= 5.4.1.CVE-2025-62030tagdivtagdiv_composer+1EPSS score0.20%
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tagDiv tagDiv Composer td-composer.This issue affects tagDiv Composer: from n/a through <= 5.4.1.CVE-2025-53222tagdivtagdiv opt-in builder+1EPSS score0.20%
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tagDiv tagDiv Opt-In Builder td-subscription allows Reflected XSS.This issue affects tagDiv Opt-In Builder: from n/a through <= 1.7.3.CVE-2025-3510tagdivcomposer+2EPSS score0.28%
The tagDiv Composer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple shortcodes in all versions up to, and including, 5.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.CVE-2025-50005tagdivtagdiv_composer+1EPSS score0.26%
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tagDiv tagDiv Composer td-composer allows DOM-Based XSS.This issue affects tagDiv Composer: from n/a through <= 5.4.2.CVE-2025-50001tagdivtagdiv_composer+1EPSS score0.15%
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tagDiv tagDiv Composer td-composer allows Reflected XSS.This issue affects tagDiv Composer: from n/a through <= 5.4.2.CVE-2022-2627tagdivnewspaper+2EPSS score1.08%
The Newspaper WordPress theme before 12 does not sanitise a parameter before outputting it back in an HTML attribute via an AJAX action, leading to a Reflected Cross-Site Scripting.CVE-2022-2167tagdivnewspaper+2EPSS score0.60%
The Newspaper WordPress theme before 12 does not sanitise a parameter before outputting it back in an HTML attribute via an AJAX action, leading to a Reflected Cross-Site ScriptingCVE-2022-3477newsmag_projectnewsmag+8EPSS score3.90%
The tagDiv Composer WordPress plugin before 3.5, required by the Newspaper WordPress theme before 12.1 and Newsmag WordPress theme before 5.2.2, does not properly implement the Facebook login feature, allowing unauthenticated attackers to login as any user by just knowing their email addressCVE-2017-18634tagdivnewspaper+1EPSS score2.17%
The newspaper theme before 6.7.2 for WordPress has script injection via td_ads[header] to admin-ajax.php.CVE-2024-13645tagdivtagdiv_composer+1EPSS score0.73%
The tagDiv Composer plugin for WordPress is vulnerable to PHP Object Instantiation in all versions up to, and including, 5.3 via module parameter. This makes it possible for unauthenticated attackers to Instantiate a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.CVE-2024-5212tagdivtagdiv_composer+1EPSS score0.37%
The tagDiv Composer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘envato_code[]’ parameter in all versions up to, and including, 5.0 due to insufficient input sanitization and output escaping within the on_ajax_register_forum_user function. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.