CVE Database / CVE-2026-39712

CVE · Medium

CVE-2026-39712 — tagDiv Composer [td-composer] <= 5.4.3 (unfixed)

CVE Vulnerability Type Severity Affected Fixed in Published Status
CVE-2026-39712 tagDiv Composer [td-composer] <= 5.4.3 (unfixed) — Medium 5.3 < 5.4.3 5.4.3 2026-03-02 —

CVE-2026-39712

The The tagDiv Composer plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.4.4. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.

Source: Wordfence

Scan your WordPress site free

No signup, no credit card — enter your URL and get a security report in seconds.

Run a free scan Get the plugin (free)

See the full security page for this plugin Browse the CVE database Browse all security findings