What is the CVSS score of CVE-2026-39712?

CVE-2026-39712 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Tagdiv Composer CVE-2026-39712

EUVD-2026-20421 MEDIUM

Basic XSS (CWE-80)

2026-04-08 Patchstack

GHSA-hwgv-97jr-4gh8

XSS Tagdiv Composer

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Apr 08, 2026 - 08:45 euvd

EUVD-2026-20421

Analysis Generated

Apr 08, 2026 - 08:45 vuln.today

CVE Published

Apr 08, 2026 - 08:30 nvd

MEDIUM 5.3

DescriptionCVE.org

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in tagDiv tagDiv Composer td-composer allows Code Injection.This issue affects tagDiv Composer: from n/a through <= 5.4.3.

AnalysisAI

Improper neutralization of HTML script tags in tagDiv Composer plugin versions up to 5.4.3 allows unauthenticated remote attackers to inject arbitrary code through shortcode execution, resulting in stored cross-site scripting (XSS). The vulnerability exploits insufficient input sanitization in the plugin's composer functionality, enabling attackers to inject malicious scripts that execute in the context of affected web pages. While EPSS scoring indicates low real-world exploitation probability (0.03%, 8th percentile), the CISA SSVC framework notes the attack is automatable and results in partial technical impact; no public exploit code or active exploitation has been identified at time of analysis.

Technical ContextAI

The vulnerability stems from CWE-80 (Improper Neutralization of Script-Related HTML Tags), a foundational XSS weakness class where user-supplied input containing HTML script tags is not properly sanitized before rendering in web pages. tagDiv Composer, a WordPress plugin (CPE: cpe:2.3:a:tagdiv:tagdiv_composer:*:*:*:*:*:*:*:*), processes user input through its composer interface and shortcode engine. The flaw allows attackers to bypass basic HTML tag filtering mechanisms, likely through improper escaping or incomplete blacklisting of script-related tags. This affects the plugin's core content composition functionality, where shortcode parsing and rendering does not adequately neutralize embedded script payloads before output to the DOM.

RemediationAI

Upgrade tagDiv Composer plugin to a patched version released after 5.4.3; vendors typically release patch versions immediately following advisory disclosure (consult https://patchstack.com/database/Wordpress/Plugin/td-composer or the official tagDiv Composer repository for the exact patched version number and release date). As immediate mitigation pending patch deployment, disable or restrict access to the composer interface for untrusted users, implement Web Application Firewall (WAF) rules to block shortcode payloads containing script tags, and audit published content for injected shortcodes. If the plugin cannot be updated immediately, consider temporarily deactivating tagDiv Composer until a patched release is available.