CVE-2026-57734: tagDiv Composer XSS Vulnerability

CVE-2026-57734 Overview

CVE-2026-57734 is a reflected cross-site scripting (XSS) vulnerability in the tagDiv Composer (td-composer) WordPress plugin. The flaw affects all versions up to and including 5.4.3. It results from improper neutralization of user-supplied input during web page generation, mapped to [CWE-79]. An attacker can craft a malicious URL that, when visited by an authenticated or unauthenticated user, executes arbitrary JavaScript in the victim's browser session. The vulnerability requires user interaction and can cross security boundaries (scope changed), enabling session token theft, defacement, or redirection to attacker-controlled infrastructure.

Critical Impact
Successful exploitation allows attackers to execute arbitrary JavaScript in the victim's browser, potentially hijacking sessions and performing actions on behalf of authenticated WordPress users.

Affected Products

tagDiv Composer (td-composer) WordPress plugin versions up to and including 5.4.3
WordPress installations bundling the tagDiv Composer plugin
Sites using tagDiv themes that depend on the tagDiv Composer plugin

Discovery Timeline

2026-07-13 - CVE-2026-57734 published to NVD
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-57734

Vulnerability Analysis

The tagDiv Composer plugin fails to sanitize or encode user-controlled input before reflecting it in HTTP responses. When the plugin renders a request parameter into HTML, JavaScript context, or attribute context without proper escaping, attacker-supplied markup executes in the requesting user's browser. Because the attack scope is changed, the injected script can influence resources beyond the vulnerable component, including cookies scoped to the parent WordPress domain. Exploitation requires convincing a user to click a crafted link, typically delivered via phishing, social media, or an attacker-controlled site.

Root Cause

The root cause is missing input neutralization on request parameters processed by the td-composer plugin prior to output. The plugin does not apply WordPress escaping helpers such as esc_html(), esc_attr(), or wp_kses() before echoing parameter values into rendered pages. This category of flaw falls under [CWE-79] Improper Neutralization of Input During Web Page Generation.

Attack Vector

The attack vector is network-based with low complexity and no privileges required, though user interaction is necessary. An attacker crafts a URL containing a JavaScript payload in a vulnerable parameter processed by td-composer. The victim clicks the link and the server reflects the payload into the HTML response, causing browser execution. See the Patchstack Vulnerability Report for technical details on the affected parameter and reflection sink.

Detection Methods for CVE-2026-57734

Indicators of Compromise

Web server access logs containing URL parameters with encoded <script>, onerror=, onload=, or javascript: payloads targeting td-composer endpoints
Referrer headers originating from phishing domains or URL shorteners pointing to WordPress pages using tagDiv Composer
Unusual outbound requests from user browsers to external hosts immediately following visits to tagDiv-powered pages
WordPress audit log entries showing unexpected administrative actions performed by legitimate users shortly after link visits

Detection Strategies

Deploy a web application firewall (WAF) with rules that inspect query strings and POST bodies for reflected XSS signatures against td-composer request paths
Enable request logging with full query string capture and alert on HTML or JavaScript metacharacters in parameters consumed by the plugin
Correlate reflected input in HTTP responses against the same request parameters using response-body inspection tools

Monitoring Recommendations

Monitor for spikes in 200-OK responses containing script tags or event handler attributes originating from tagDiv plugin routes
Track authenticated administrator sessions for anomalous IP or user-agent changes indicative of session hijacking
Alert on Content Security Policy (CSP) violation reports referencing inline script execution on pages served by WordPress

How to Mitigate CVE-2026-57734

Immediate Actions Required

Update the tagDiv Composer plugin to a version later than 5.4.3 once the vendor publishes a patched release
Restrict access to WordPress administrative interfaces using IP allowlisting or VPN gating until patched
Deploy WAF signatures blocking common XSS payloads on requests to td-composer endpoints
Rotate WordPress administrator credentials and invalidate active sessions if suspicious link visits are observed

Patch Information

At the time of publication, the vulnerability affects tagDiv Composer versions through 5.4.3. Administrators should monitor the Patchstack Vulnerability Report and the tagDiv vendor channels for a fixed release, then apply the update through the WordPress plugin management console.

Workarounds

Deactivate the tagDiv Composer plugin until a patched version is available if the site can tolerate the loss of functionality
Implement a strict Content Security Policy that disallows inline scripts and untrusted script sources to limit XSS impact
Configure the WAF to strip or block requests containing HTML tags, event handlers, or javascript: schemes in query parameters
Require administrators to use isolated browsers or browser profiles when managing WordPress to reduce session token exposure

bash

# Example ModSecurity rule to block reflected XSS payloads targeting td-composer
SecRule REQUEST_URI "@contains /wp-content/plugins/td-composer/" \
    "id:1057734,phase:2,deny,status:403,log,\
    msg:'Potential CVE-2026-57734 XSS attempt against tagDiv Composer',\
    chain"
    SecRule ARGS "@rx (?i)(<script|onerror=|onload=|javascript:)" \
        "t:none,t:urlDecodeUni,t:htmlEntityDecode"