CVE-2026-12561

Name of the Vulnerable Software and Affected Versions tagDiv Composer versions prior to 5.4.6

Description The plugin contains a Stored Cross-Site Scripting issue within the vc raw html shortcode. The vc raw html::render() function fails to properly sanitize input and escape output by base64-decoding shortcode content and inserting it directly into the page HTML. This process bypasses the wp kses post() filter, which is a WordPress function used to sanitize HTML content, because the filter does not decode base64 text. Consequently, authenticated attackers with Contributor-level access or higher can inject arbitrary web scripts that execute when a user, such as an Editor or Administrator, views the affected page.

Recommendations Update tagDiv Composer to version 5.4.6 or later. As a temporary mitigation, restrict the use of the vc raw html shortcode for users with Contributor-level access.