# cve.now: Tagdiv

The newest entries naming Tagdiv as an affected vendor (up to 200), of 29 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-96330](https://cve.now/CVE-2026-96330.md): WordPress tagDiv Opt-In Builder plugin \<= 1.7.6 - SQL Injection vulnerability (CVSS 9.3)
- [CVE-2026-96329](https://cve.now/CVE-2026-96329.md): WordPress tagDiv Opt-In Builder plugin \<= 1.7.6 - SQL Injection vulnerability (CVSS 8.5)
- [CVE-2026-12561](https://cve.now/CVE-2026-12561.md): tagDiv Composer \<= 5.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2026-57734](https://cve.now/CVE-2026-57734.md): WordPress tagDiv Composer plugin \<= 5.4.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-57733](https://cve.now/CVE-2026-57733.md): WordPress tagDiv Cloud Library plugin \<= 3.9.4 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-57732](https://cve.now/CVE-2026-57732.md): WordPress tagDiv Opt-In Builder plugin \<= 1.7.4 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-39712](https://cve.now/CVE-2026-39712.md): WordPress tagDiv Composer plugin \<= 5.4.3 - Arbitrary Shortcode Execution vulnerability (CVSS 5.3)
- [CVE-2026-39692](https://cve.now/CVE-2026-39692.md): WordPress tagDiv Composer plugin \<= 5.4.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2025-53222](https://cve.now/CVE-2025-53222.md): WordPress tagDiv Opt-In Builder plugin \<= 1.7.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2025-50001](https://cve.now/CVE-2025-50001.md): WordPress tagDiv Composer plugin \<= 5.4.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2025-50005](https://cve.now/CVE-2025-50005.md): WordPress tagDiv Composer plugin \<= 5.4.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2025-62032](https://cve.now/CVE-2025-62032.md): WordPress tagDiv Cloud Library plugin \< 3.9.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2025-62031](https://cve.now/CVE-2025-62031.md): WordPress tagDiv Composer plugin \<= 5.4.1 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2025-62030](https://cve.now/CVE-2025-62030.md): WordPress tagDiv Composer plugin \<= 5.4.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2025-2806](https://cve.now/CVE-2025-2806.md): tagDiv Composer \<= 5.3 - Reflected Cross-Site Scripting via 'data' (CVSS 6.1)
- [CVE-2025-3510](https://cve.now/CVE-2025-3510.md): tagDiv Composer \<= 5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes (CVSS 6.4)
- [CVE-2025-2890](https://cve.now/CVE-2025-2890.md): tagDiv Opt-In Builder \<= 1.7 - Authenticated (Subscriber+) SQL Injection via subscriptionCouponId Parameter (CVSS 6.5)
- [CVE-2024-13645](https://cve.now/CVE-2024-13645.md): TagDiv Composer \<= 5.3 - Unauthenticated Arbitrary PHP Object Instantiation (CVSS 9.8)
- [CVE-2025-1705](https://cve.now/CVE-2025-1705.md): tagDiv Composer \<= 5.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting (CVSS 6.1)
- [CVE-2025-2804](https://cve.now/CVE-2025-2804.md): tagDiv Composer \<= 5.3 - Reflected Cross-Site Scripting via 'account\_id' and 'account\_username' (CVSS 6.1)
- [CVE-2024-3886](https://cve.now/CVE-2024-3886.md): tagDiv Composer \<= 5.0 - Reflected Cross-Site Scripting via envato\_code\[\] (CVSS 6.1)
- [CVE-2024-5212](https://cve.now/CVE-2024-5212.md): tagDiv Composer \<= 5.0 - Reflected Cross-Site Scripting via envato\_code\[\] (CVSS 6.1)
- [CVE-2023-3416](https://cve.now/CVE-2023-3416.md): tagDiv Opt-In Builder \<= 1.4.4 - Authenticated (Admin+) SQL Injection (CVSS 7.2)
- [CVE-2023-3419](https://cve.now/CVE-2023-3419.md): tagDiv Opt-In Builder \<= 1.4.4 - Authenticated (Admin+) SQL Injection (CVSS 7.2)
- [CVE-2024-3813](https://cve.now/CVE-2024-3813.md): tagDiv Composer \<= 4.8 - Authenticated (Contributor+) Local File Inclusion via Shortcode (CVSS 8.8)
- [CVE-2024-3814](https://cve.now/CVE-2024-3814.md): tagDiv Composer \<= 4.8 - Authenticated (Author+) Stored Cross-Site Scripting via Attachment Meta (CVSS 5.5)
- [CVE-2024-3888](https://cve.now/CVE-2024-3888.md): tagDiv Composer \<= 4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via button Shortcode (CVSS 6.4)
- [CVE-2023-39166](https://cve.now/CVE-2023-39166.md): WordPress tagDiv Composer Plugin \< 4.4 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 7.1)
- [CVE-2022-3477](https://cve.now/CVE-2022-3477.md): tagDiv Composer \< 3.5 - Unauthenticated Account Takeover (CVSS 9.8)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/tagdiv
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.