CVE-2024-3888

The tagDiv Composer plugin for WordPress contains a stored cross-site scripting vulnerability in its button shortcode affecting versions 4.8 and earlier, caused by inadequate sanitization and escaping of user-supplied shortcode attributes. Authenticated users with contributor permissions or higher can embed malicious scripts into pages, which execute when visitors view those pages. This vulnerability is specific to the tagDiv Newspaper theme and may not affect installations using alternative themes.

Based on public CVE data (MITRE/NVD).