CVE-2026-12561

The tagDiv Composer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the vc_raw_html shortcode in all versions up to and including 5.4.5. This is due to insufficient input sanitization and output escaping in the vc_raw_html::render() method, which base64-decodes shortcode content (after a strip_tags() that is bypassed because the encoded payload contains no tags on save) and concatenates the result directly into the page HTML. Because WordPress's save-time wp_kses_post() filter only sees the inert base64 text inside a normal shortcode bracket and does not decode it, the dangerous tags survive into post_content and are emitted unescaped at render time. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page (for example, when an Editor or Administrator previews the pending post).

• CWE-79

• https://tagdiv.com/tagdiv-composer-page-builder-basics/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/48ae6e52-4a66-4676-9528-6f997ef54c7a?source=cve

Published

Aug 25, 2026

Last Modified

Sep 28, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-12555Potential security vulnerabilities have been identified in H…7.7
• CVE-2026-12556Potential security vulnerabilities have been identified in H…7.7
• CVE-2026-12557The Ninja Forms - File Uploads plugin for WordPress is vulne…5.3
• CVE-2026-12559A Stored Cross-Site Scripting (XSS) vulnerability has been i…7.3
• CVE-2026-1256The YS LeadGen plugin for WordPress is vulnerable to authori…6.4
• CVE-2026-12560The Editorial Rating – Product Review & Rating System plugin…4.4
• CVE-2026-125612Improper neutralization of special elements used in an SQL c…8.8
• CVE-2026-12562The RCU II+ and Multiload II+ are vulnerable to an unauthent…8.8
• CVE-2026-12564A flaw was found in the AAP Controller's HashiCorp Vault cre…9.6
• CVE-2026-12565The unarchive internal module's archive extraction commands …5.3
• CVE-2026-125652A flaw was found in the keycloak-services component of Keycl…6.8
• CVE-2026-12566The docker_pull module uses the realm parameter from a Docke…3.1