Plugin security history

tagDiv Composer Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 22 vulnerability records associated with tagDiv Composer, published between 2022 and 2026.

Dataset last synchronized: 2026-08-03 00:31:25 UTC

At a glance

Security Snapshot

22Total records

2Critical

3High

17Medium

0Low

0Informational

22Patched records

0Currently marked unpatched

2022-10-24First disclosure

2026-07-06Latest disclosure

22 of 22CVE coverage

Use this history

Check and watch tagDiv Composer.

A history record does not establish whether the version installed on your website is affected. Enter the exact version in the checker, or add this software to a private Critical/High alert watchlist.

Check my installed version Watch tagDiv Composer

Year-by-Year Timeline

Year	Records	Relative volume
2022	1	1 records
2023	4	4 records
2024	5	5 records
2025	7	7 records
2026	5	5 records

Severity Breakdown

Severity	Records	Share
Critical	2	9.1%
High	3	13.6%
Medium	17	77.3%

Vulnerability-Type Breakdown

Cross-Site Scripting

17 records77.3%

First: 2023. Latest: 2026.

Other

3 records13.6%

First: 2024. Latest: 2026.

Authentication Bypass

1 record4.5%

First: 2022. Latest: 2022.

CSRF

1 record4.5%

First: 2023. Latest: 2023.

Patch Status

Patched: 22
Currently marked unpatched: 0
Unknown status: 0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

5.4.6
5.4.3
5.4.5
5.4.2
5.4.1
5.4
5.1
4.9
4.2
4.4
4.0
3.5

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected range	Vulnerability	Published	Patched version	Severity
`*-5.4.5`	tagDiv Composer <= 5.4.5 - Reflected Cross-Site Scripting	July 6, 2026	5.4.6	Medium
`*-5.4.2`	tagDiv Composer <= 5.4.2 - Reflected Cross-Site Scripting	March 10, 2026	5.4.3	Medium
`*-5.4.4`	tagDiv Composer <= 5.4.4 - Unauthenticated Arbitrary Shortcode Execution	March 2, 2026	5.4.5	Medium
`*-5.4.4`	tagDiv Composer <= 5.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting	February 24, 2026	5.4.5	Medium
`*-5.4.2`	tagDiv Composer <= 5.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting	January 8, 2026	5.4.3	Medium
`*-5.4.1`	tagDiv Composer <= 5.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting	October 16, 2025	5.4.2	Medium
`*-5.4.1`	tagDiv Composer <= 5.4.1 - Unauthenticated Stored Cross-Site Scripting	October 9, 2025	5.4.2	High
`*-5.3`	tagDiv Composer <= 5.3 - Reflected Cross-Site Scripting via 'data'	May 7, 2025	5.4	Medium
`*-5.4`	tagDiv Composer <= 5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes	May 1, 2025	5.4.1	Medium
`*-5.3`	TagDiv Composer <= 5.3 - Unauthenticated Arbitrary PHP Object Instantiation	April 3, 2025	5.4	Critical
`*-5.3`	tagDiv Composer <= 5.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting	March 27, 2025	5.4	Medium
`*-5.3`	tagDiv Composer <= 5.3 - Reflected Cross-Site Scripting via 'account_id' and 'account_username'	March 27, 2025	5.4	Medium
`*-5.0`	tagDiv Composer <= 5.0 - Reflected Cross-Site Scripting via envato_code[]	August 30, 2024	5.1	Medium
`*-5.0`	tagDiv Composer <= 5.0 - Reflected Cross-Site Scripting via envato_code[]	August 30, 2024	5.1	Medium
`*-4.8`	tagDiv Composer <= 4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via button Shortcode	June 3, 2024	4.9	Medium
`*-4.8`	tagDiv Composer <= 4.8 - Authenticated (Contributor+) Local File Inclusion via Shortcode	April 18, 2024	4.9	High
`*-4.8`	tagDiv Composer <= 4.8 - Authenticated (Author+) Stored Cross-Site Scripting via Attachment Meta	April 18, 2024	4.9	Medium
`*-4.1`	tagDiv Composer <= 4.1 - Unauthenticated Stored Cross-Site Scripting	August 17, 2023	4.2	High
`*-4.1`	tagDiv Composer <= 4.1 - Authenticated (Admin+) Stored Cross-Site Scripting	August 17, 2023	4.2	Medium
`[*, 4.4)`	tagDiv Composer < 4.4 - Cross-Site Request Forgery to Cross-Site Scripting	July 25, 2023	4.4	Medium
`[*, 4.0)`	tagDiv Composer < 4.0 - Reflected Cross-Site Scripting via ‘td_video_url’	April 17, 2023	4.0	Medium
`[*, 3.5)`	tagDiv Composer < 3.5 - Unauthorized Account Access and Privilege Escalation	October 24, 2022	3.5	Critical

Selected source records

Latest Records

MediumCVE-2026-57734

tagDiv Composer <= 5.4.5 - Reflected Cross-Site Scripting

Published: July 6, 2026

Affected versions: *-5.4.5
Patched versions: 5.4.6

Original Wordfence record

MediumCVE-2025-50001

tagDiv Composer <= 5.4.2 - Reflected Cross-Site Scripting

Published: March 10, 2026

Affected versions: *-5.4.2
Patched versions: 5.4.3

Original Wordfence record

MediumCVE-2026-39712

tagDiv Composer <= 5.4.4 - Unauthenticated Arbitrary Shortcode Execution

Published: March 2, 2026

Affected versions: *-5.4.4
Patched versions: 5.4.5

Original Wordfence record

MediumCVE-2026-39692

tagDiv Composer <= 5.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: February 24, 2026

Affected versions: *-5.4.4
Patched versions: 5.4.5

Original Wordfence record

MediumCVE-2025-50005

tagDiv Composer <= 5.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: January 8, 2026

Affected versions: *-5.4.2
Patched versions: 5.4.3

Original Wordfence record

MediumCVE-2025-62030

tagDiv Composer <= 5.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: October 16, 2025

Affected versions: *-5.4.1
Patched versions: 5.4.2

Original Wordfence record

HighCVE-2025-62031

tagDiv Composer <= 5.4.1 - Unauthenticated Stored Cross-Site Scripting

Published: October 9, 2025

Affected versions: *-5.4.1
Patched versions: 5.4.2

Original Wordfence record

MediumCVE-2025-2806

tagDiv Composer <= 5.3 - Reflected Cross-Site Scripting via 'data'

Published: May 7, 2025

Affected versions: *-5.3
Patched versions: 5.4

Original Wordfence record

Highest-Severity Records

CriticalCVE-2024-13645

TagDiv Composer <= 5.3 - Unauthenticated Arbitrary PHP Object Instantiation

Published: April 3, 2025

Affected versions: *-5.3
Patched versions: 5.4

Original Wordfence record

CriticalCVE-2022-3477

tagDiv Composer < 3.5 - Unauthorized Account Access and Privilege Escalation

Published: October 24, 2022

Affected versions: *-12
Patched versions: 12.1

Affected versions: *-5.2.1
Patched versions: 5.2.2

Affected versions: [*, 3.5)
Patched versions: 3.5

Original Wordfence record

HighCVE-2024-3813

tagDiv Composer <= 4.8 - Authenticated (Contributor+) Local File Inclusion via Shortcode

Published: April 18, 2024

Affected versions: *-4.8
Patched versions: 4.9

Original Wordfence record

HighCVE-2025-62031

tagDiv Composer <= 5.4.1 - Unauthenticated Stored Cross-Site Scripting

Published: October 9, 2025

Affected versions: *-5.4.1
Patched versions: 5.4.2

Original Wordfence record

HighCVE-2023-3169

tagDiv Composer <= 4.1 - Unauthenticated Stored Cross-Site Scripting

Published: August 17, 2023

Affected versions: *-4.1
Patched versions: 4.2

Original Wordfence record

MediumCVE-2026-39712

tagDiv Composer <= 5.4.4 - Unauthenticated Arbitrary Shortcode Execution

Published: March 2, 2026

Affected versions: *-5.4.4
Patched versions: 5.4.5

Original Wordfence record

MediumCVE-2026-39692

tagDiv Composer <= 5.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: February 24, 2026

Affected versions: *-5.4.4
Patched versions: 5.4.5

Original Wordfence record

MediumCVE-2025-62030

tagDiv Composer <= 5.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: October 16, 2025

Affected versions: *-5.4.1
Patched versions: 5.4.2

Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware Removal WordPress Security Maintenance Contact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory