CVE-2026-12561: tagDiv Composer <= 5.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
The tagDiv Composer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the vcrawhtml shortcode in all versions up to and including 5.4.5. This is due to insufficient input sanitization and output escaping in the vcrawhtml::render() method, which base64-decodes shortcode content (after a striptags() that is bypassed because the encoded payload contains no tags on save) and concatenates the result directly into the page HTML. Because WordPress's save-time wpksespost() filter only sees the inert base64 text inside a normal shortcode bracket and does not decode it, the dangerous tags survive into postcontent and are emitted unescaped at render time. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page (for example, when an Editor or Administrator previews the pending post).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
tagDiv Composerto a version that resolves this vulnerability.Fixed in 5.4.5 - Compensating control
Restrict WordPress contributor/editor access so only trusted authenticated users with less-than-Contributor capability can edit/preview content that could include the vc_raw_html shortcode.
- Compensating control
Remove or block use of the vc_raw_html shortcode in tagDiv Composer until the vulnerable plugin version is remediated, since the vulnerability is in vc_raw_html::render() base64-decoding and injecting output directly into page HTML.
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated WordPress user with at least Contributor-level access can inject the malicious shortcode content. Exploitation does not require user interaction from the attacker.
When does the injected script execute?
The script executes when someone accesses a page containing the injected content. This can include an Editor or Administrator previewing a Contributor's pending post.
Are sites using affected versions protected by WordPress content filtering?
No. The normal save-time wp_kses_post() filtering sees only base64-encoded text inside the shortcode and does not decode it. The payload is decoded later and emitted into page HTML without escaping.