PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-39712 tagDiv CVE debrief

CVE-2026-39712 is a MEDIUM severity vulnerability in tagDiv Composer, a WordPress plugin. The issue is an Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability, which allows Code Injection. This type of vulnerability can lead to malicious actions, potentially impacting users of the affected plugin. The CVE record was published on 2026-04-08T09:16:44.130Z and was last modified on 2026-07-24T20:10:00.147Z. The NVD entry is currently Deferred. Users of tagDiv Composer, especially those using versions from n/a through <= 5.4.3, should be aware of this vulnerability and take necessary actions to mitigate the risk.

Vendor
tagDiv
Product
tagDiv Composer
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-08
Original CVE updated
2026-07-24
Advisory published
2026-04-08
Advisory updated
2026-07-24

Who should care

Users of tagDiv Composer, especially those using versions from n/a through <= 5.4.3, should be aware of this vulnerability and take necessary actions to mitigate the risk. This includes verifying the version of tagDiv Composer in use, applying patches or updates to version 5.4.3 or later, and implementing compensating controls, such as web application firewalls or intrusion detection systems.

Technical summary

The vulnerability is caused by improper neutralization of script-related HTML tags in a web page, leading to a Basic XSS vulnerability. This allows attackers to inject code, potentially leading to malicious actions. The CVSS score for this vulnerability is 5.3, indicating a MEDIUM severity level. The vulnerability affects tagDiv Composer from n/a through <= 5.4.3. Users should verify the version of tagDiv Composer in use and apply patches or updates to version 5.4.3 or later.

Defensive priority

MEDIUM

Recommended defensive actions

  • Inventory and verify the version of tagDiv Composer in use
  • Apply patches or updates to tagDiv Composer to version 5.4.3 or later
  • Implement compensating controls, such as web application firewalls or intrusion detection systems
  • Monitor for suspicious activity and exception tracking

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. Further investigation and verification are necessary to fully understand the scope and impact of this vulnerability. The vulnerability affects tagDiv Composer from n/a through <= 5.4.3. Users should verify the version of tagDiv Composer in use and check for any additional information from the vendor or other reliable sources.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-39712 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-39712

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-39712 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-39712

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.