CVE-2026-12561 is a stored cross-site scripting vulnerability in the tagDiv Composer plugin for WordPress, affecting all versions up to and including 5.4.5. The vulnerability exists because the vc_raw_html::render() method base64-decodes shortcode content after a strip_tags() call that is bypassed due to the encoded payload containing no tags on save. WordPress's save-time wp_kses_post() filter only processes the inert base64 text inside the shortcode brackets and does not decode it, allowing dangerous HTML tags to persist in post_content. When the page is rendered, this unescaped content is concatenated directly into the HTML, enabling script injection. Authenticated attackers with Contributor-level access or higher can exploit this to inject scripts that execute when Editors, Administrators, or other users view the injected page.

An attacker with Contributor-level or higher privileges can inject arbitrary web scripts into pages, which will execute in the context of users who view the affected content, such as Editors or Administrators previewing posts. This can lead to information disclosure and limited integrity impact but does not affect availability. The vulnerability has a CVSS 3.1 base score of 6.4 (medium severity), reflecting network attack vector, low attack complexity, privileges required, no user interaction, and impact on confidentiality and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access and above to trusted users only. Monitor for plugin updates from tagDiv that address this vulnerability and apply them promptly once released.