CVE-2026-39692

The tagDiv Composer plugin for WordPress contains a security flaw that allows malicious users with at least contributor privileges to embed unauthorized code snippets into certain webpage elements. This vulnerability arises from inadequate checks on input data and insufficient protection against potentially hazardous content being displayed on the affected site. As a result, when an unsuspecting visitor views a page containing injected code, it will execute.

Based on public CVE data (MITRE/NVD).