CVE-2023-3170: The tagDiv Composer WordPress plugin before 4.2, used as a companion by the Newspaper and Newsmag themes from tagDiv, does not validate and escape some…

PriorityP418medium4.8CVSS 3.1

AVNACLPRHUIRSCCLILAN

EPSS

0.38%

29.5th percentile

The tagDiv Composer WordPress plugin before 4.2, used as a companion by the Newspaper and Newsmag themes from tagDiv, does not validate and escape some settings, which could allow users with Admin privileges to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

Affected

2 ranges

Vendor	Product	Version range	Fixed in
google	chrome_chrome	—	—
tagdiv	tagdiv_composer	< 4.2	4.2

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.