CVE-2026-12561: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in tagDiv tagDiv Composer

The tagDiv Composer plugin for WordPress suffers from a stored XSS vulnerability via the vc_raw_html shortcode in versions up to 5.4.5. The vulnerability stems from the vc_raw_html::render() method, which base64-decodes shortcode content after a strip_tags() call that can be bypassed because the encoded payload contains no tags at save time. WordPress's wp_kses_post() filter only processes the inert base64 text inside the shortcode and does not decode it, allowing dangerous HTML tags to persist in post_content. When the shortcode is rendered, the decoded content is concatenated directly into the page HTML without escaping, enabling script injection. Authenticated attackers with Contributor or higher privileges can exploit this to inject scripts that execute when other users access the page.

An attacker with Contributor-level or higher access can inject malicious scripts into pages or posts via the vulnerable shortcode. These scripts execute in the context of users who view the infected content, such as Editors or Administrators previewing posts, potentially leading to session hijacking, privilege escalation, or other malicious actions. The vulnerability has a CVSS 3.1 score of 6.4 (medium severity), reflecting its network attack vector, low attack complexity, and limited privileges required.

No official patch or fix is currently documented in the provided data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Contributor-level or higher access to trusted users only. Avoid using the vc_raw_html shortcode or disable the tagDiv Composer plugin if possible to prevent exploitation.