9.8
Critical
CVE-2022-3477 The tagDiv Composer WordPress plugin before 3.5, required by the Newspaper WordPress theme before 12.1 and Newsmag…
Description
The tagDiv Composer WordPress plugin before 3.5, required by the Newspaper WordPress theme before 12.1 and Newsmag WordPress theme before 5.2.2, does not properly implement the Facebook login feature, allowing unauthenticated attackers to login as any user by just knowing their email address
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| tagDiv Composer 3.5 | earliest → < 3.5 | 3.5 |
| Newspaper 12.1 | earliest → < 12.1 | 12.1 |
| Newsmag 5.2 | earliest → < 5.2.2 | 5.2.2 |
Other CVEs of tagDiv Composer
The 20 CVEs of tagDiv Composer →
CVE-2026-12561
The tagDiv Composer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the vc_raw_html shortcode in…
6.4
Medium
CVE-2026-57734
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tagDiv tagDiv…
7.1
High
CVE-2026-39712
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in tagDiv tagDiv Composer…
5.3
Medium
CVE-2026-39692
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tagDiv tagDiv…
6.5
Medium