CVE-2024-3888

Vulnerability

The tagDiv Composer plugin for WordPress, in all versions up to and including 4.8, contains a stored cross-site scripting (XSS) vulnerability in the plugin's button shortcode. The root cause is insufficient input sanitization and output escaping on user-supplied attributes [1]. This flaw is specifically tied to the tagDiv Newspaper theme; if another theme (e.g., NewsMag) is active, the vulnerable code may not be present [Description].

Exploitation

An attacker must be authenticated as a contributor-level user or higher to exploit this vulnerability. The attacker can inject arbitrary web scripts into pages by supplying crafted attributes in the button shortcode. The injected script will execute whenever a victim user accesses the affected page [Description].

Impact

Successful exploitation allows the attacker to execute arbitrary client-side code in the context of the victim's browser session, potentially leading to session hijacking, defacement, or theft of sensitive information [Description][1]. The stored nature of the XSS means the payload persists and can affect multiple users.

Mitigation

The vendor has not released a patch at the time of publication. Users are advised to limit contributor-level access and disable the vulnerable shortcode if possible. The vulnerability only applies when using the tagDiv Newspaper theme [Description][1].