CVE-2026-12561: tagDiv Composer WordPress XSS Vulnerability

CVE-2026-12561 is a stored XSS vulnerability in the tagDiv Composer WordPress plugin affecting versions up to 5.4.5. Attackers with Contributor access can inject malicious scripts via base64-encoded payloads. This article covers technical details, affected versions, impact analysis, and mitigation strategies.

CVE-2026-12561 Overview

CVE-2026-12561 is a Stored Cross-Site Scripting [CWE-79] vulnerability in the tagDiv Composer plugin for WordPress. All versions up to and including 5.4.5 are affected. The vc_raw_html shortcode base64-decodes user-supplied content and concatenates the result directly into rendered HTML, bypassing WordPress's wp_kses_post() save-time filter. Authenticated attackers with Contributor-level access can inject arbitrary JavaScript that executes when Editors or Administrators preview the pending post.

Critical Impact
Contributor-level accounts can escalate influence by injecting scripts that execute in higher-privileged users' browser sessions during post preview or publication.

Affected Products

tagDiv Composer plugin for WordPress
All versions through 5.4.5
WordPress sites allowing Contributor-level registrations

Discovery Timeline

2026-08-25 - CVE-2026-12561 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-12561

Vulnerability Analysis

The flaw resides in the vc_raw_html::render() method of the tagDiv Composer plugin. The method accepts shortcode content that is base64-encoded, applies strip_tags() to the encoded string, then base64-decodes the result and emits it directly into page HTML. Because base64 text contains no HTML tags, strip_tags() performs no filtering on the encoded payload.

WordPress applies wp_kses_post() when saving post_content, but the sanitizer only sees the inert base64 string wrapped in a standard shortcode bracket. The sanitizer does not decode shortcode arguments, so dangerous tags survive into the database. At render time, the decoded payload emerges unescaped in the HTML response, executing in any viewer's browser.

Root Cause

The root cause is a sanitization-decode order mismatch. Input sanitization occurs before base64 decoding, and output escaping is absent at render. The plugin trusts shortcode content that has already passed WordPress's default filters, but those filters never inspect the decoded form.

Attack Vector

An attacker with a Contributor account authors a post containing a vc_raw_html shortcode whose content is a base64-encoded JavaScript payload. The Contributor submits the post for review. When an Editor or Administrator previews or publishes the pending post, the decoded script executes in their authenticated session, enabling account takeover, session theft, or backend actions performed as the higher-privileged user.

Refer to the Wordfence Vulnerability Report for additional technical detail.

Detection Methods for CVE-2026-12561

Indicators of Compromise

Posts containing [vc_raw_html] shortcodes with long base64 strings authored by Contributor-role accounts
Unexpected outbound requests from Editor or Administrator browsers immediately after previewing pending content
New administrative users, plugin installations, or option changes correlating with pending-post reviews
Anomalous wp-admin sessions or password reset events following content review workflows

Detection Strategies

Scan the wp_posts table for vc_raw_html shortcodes and decode embedded base64 to inspect for <script>, event handlers, or external resource loads
Review audit logs for Contributor accounts creating posts that Editors subsequently previewed
Deploy web application firewall rules that inspect decoded shortcode arguments for script indicators
Monitor browser telemetry from privileged users for script execution originating from WordPress preview URLs

Monitoring Recommendations

Log all post creations and edits by Contributor-role accounts with content diff capture
Alert on the appearance of vc_raw_html shortcodes in posts authored by non-Editor roles
Correlate admin-user activity spikes with recent pending-post preview events
Track plugin version inventory across managed WordPress sites to identify installations at or below 5.4.5

How to Mitigate CVE-2026-12561

Immediate Actions Required

Update tagDiv Composer to the patched release above version 5.4.5 as soon as the vendor makes it available
Audit existing posts and drafts for vc_raw_html shortcodes and remove any authored by Contributor accounts
Restrict Contributor account creation and review pending registrations
Rotate credentials and session tokens for any Editor or Administrator who previewed suspect pending posts

Patch Information

At publication, users should consult the tagDiv Composer documentation and the Wordfence advisory for the fixed version and upgrade guidance. Apply the fixed release across all WordPress installations running tagDiv Composer.

Workarounds

Disable the tagDiv Composer plugin until a patched version is installed
Remove Contributor-level accounts or downgrade untrusted authors to a role without shortcode authoring privileges
Use a web application firewall rule that blocks vc_raw_html shortcodes in submitted post content
Instruct Editors and Administrators to avoid previewing pending posts from untrusted Contributors until remediation is complete

bash

# Configuration example: locate vulnerable shortcodes via WP-CLI
wp db query "SELECT ID, post_author, post_status FROM wp_posts WHERE post_content LIKE '%[vc_raw_html%';"

# Temporarily disable the plugin
wp plugin deactivate td-composer