WordPress tagDiv Composer plugin <= 5.4.2 - Reflected Cross Site Scripting (XSS) vulnerability

An attacker exploiting this Reflected XSS vulnerability can inject arbitrary JavaScript code into a user's browser when they visit a specially crafted URL. This code can then be used to steal cookies, session tokens, or other sensitive information. The attacker could also redirect the user to a malicious website, deface the website, or perform actions on behalf of the user without their knowledge. The blast radius extends to any user visiting the compromised page, making it a significant risk for websites heavily reliant on tagDiv Composer for page building.

Websites utilizing tagDiv Composer for page building, particularly those with user-generated content or forms, are at risk. Shared hosting environments where multiple websites share the same server resources are also more vulnerable, as a compromise on one site could potentially impact others.

• wordpress / composer / npm:

grep -r 'tagDiv Composer' /var/www/html/wp-content/plugins/
wp plugin list | grep tagDiv Composer

• generic web:

curl -I 'https://example.com/?param=<script>alert(1)</script>' | grep -i content-type

1. 2026-03-19Disclosure

   disclosure

1. Reservado2025-06-11
2. Publicada2026-03-19
3. Modificada2026-04-29
4. EPSS atualizado2026-03-26

The primary mitigation for CVE-2025-50001 is to immediately upgrade tagDiv Composer to version 5.4.3 or later. If upgrading is not immediately feasible, consider implementing input validation and output encoding on any user-supplied data displayed on pages using tagDiv Composer. Web Application Firewalls (WAFs) configured with rules to detect and block XSS payloads can provide an additional layer of protection. Monitor web server access logs for suspicious URL patterns containing JavaScript code.