CVE-2026-57734

The tagDiv Composer plugin for WordPress contains a security flaw that allows malicious code injection through URLs, which can be exploited by unverified users without requiring authentication. This vulnerability arises from inadequate filtering of input data and insufficient protection against script execution in affected versions up to 5.4.5. As a result, attackers may inject arbitrary web scripts into pages viewed by unsuspecting visitors who click on manipulated links.

Based on public CVE data (MITRE/NVD).