CVE-2023-3169: tagDiv Composer < 4.2 - Unauthenticated Stored XSS
Vulnerability summary
CVE-2023-3169 is a high (CVSS 7.2) Cross-site Scripting vulnerability in tagdiv tagdiv_composer. EPSS estimates a 1.22% chance of exploitation in the next 30 days, higher than 68.3% of scored vulnerabilities. 1 public exploit is recorded. Fixed in 4.2.
Timeline
- 11-09-2023PublishedVulnerability first disclosed.
- 26-09-2024Last modifiedVulnerability information updated.
Description
The tagDiv Composer WordPress plugin before 4.2, used as a companion by the Newspaper and Newsmag themes from tagDiv, does not have authorisation in a REST route and does not validate as well as escape some parameters when outputting them back, which could allow unauthenticated users to perform Stored Cross-Site Scripting attacks.
CVSS metrics
3 scores · 3 sources · 1 version- CVE.orgCNA6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NDiffers
- NVDNIST6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NDiffers
EPSS trend
Probability
1.22%
Chance of exploitation in the next 30 days
Percentile
68%
Versus all other CVEs
30-day change
Decrease -0.07 pp
From 1.29% on 22-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundExploit Reference (wpscan.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Tagdiv1 product
- tagdiv_composer< 4.2
Unknown1 product
- tagdiv composer< 4.2
Wordpress1 product
- td-composer≤ 4.1 (fixed in 4.2)
3 vendors · 3 products
References
2 links- wpscan.com/vulnerability/e6d8216d-ace4-48ba-afca-74da0dc5abb5ExploitVDB EntryTechnical DescriptionThird Party Advisory