What is the CVSS score of CVE-2026-57734?

CVE-2026-57734 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.3%.

Which versions of tagDiv Composer are affected by CVE-2026-57734?

The tagDiv Composer WordPress plugin (versions through 5.4.3) contains a reflected cross-site scripting vulnerability that allows remote attackers to compromise WordPress administrator sessions and…

How to fix or mitigate CVE-2026-57734?

Within 24 hours, inventory all WordPress installations using tagDiv Composer plugin and either completely disable it if functionality is non-critical, or immediately restrict access to the WordPress wp-admin directory to known IP addresses and authenticated users only. Within 7 days, implement Web Application Firewall rules blocking HTTP requests containing common XSS payloads and increase logging on all WordPress authentication events. Within 30 days, monitor the plugin repository and vendor security advisories for patch availability; once a patch is released, test it thoroughly in a staging environment for at least 7 days before production deployment.

tagDiv Composer CVE-2026-57734

EUVD-2026-43381 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-13 Patchstack

WordPress XSS Tagdiv Composer Wordpress Plugin Tagdiv

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

7.1 HIGH

Network-reachable reflected XSS needs no privileges but requires victim interaction (UI:R); DOM execution in another security context yields S:C with limited C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 10:41 vuln.today

CVE Published

Jul 13, 2026 - 08:41 cve.org

HIGH 7.1

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tagDiv tagDiv Composer td-composer allows Reflected XSS.This issue affects tagDiv Composer: from n/a through <= 5.4.3.

AnalysisAI

Reflected cross-site scripting in the tagDiv Composer (td-composer) WordPress plugin through version 5.4.3 allows remote attackers to inject arbitrary script into pages that a victim views after clicking a crafted link. Because the CVSS vector marks a scope change (S:C), successful exploitation can affect resources beyond the vulnerable component, such as the WordPress admin session context. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

tagDiv Composer is a page-building companion plugin distributed with tagDiv's Newspaper/Newsmag commercial WordPress themes, widely used for content and layout composition on news and magazine sites. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a reflected variant: user-controllable request input is echoed back into an HTTP response without adequate output encoding or input sanitization, so the browser parses attacker-supplied markup as executable script. The affected CPE is cpe:2.3:a:tagdiv:tagdiv_composer:*:*:*:*:*:*:*:*, covering all releases up to and including 5.4.3.

RemediationAI

Upgrade tagDiv Composer to a release later than 5.4.3 once the vendor publishes a fixed build; the input data does not specify an exact patched version, so no vendor-released patch version is independently confirmed at time of analysis - monitor the Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/td-composer/vulnerability/wordpress-tagdiv-composer-plugin-5-4-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve) and the tagDiv theme update channel. As a compensating control until a patched version is available, deploy a web application firewall or WordPress security plugin with virtual patching/XSS rules to filter the reflected parameter, and instruct administrators and editors not to follow untrusted links pointing at the site; a WAF rule may cause false positives on legitimate rich content, so tune it against real traffic. Reducing the number of high-privilege logged-in sessions active while browsing also limits the value of a stolen session given the scope-change impact.