CVE-2023-3169

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The tagDiv Composer WordPress plugin before 4.2, used as a companion by the Newspaper and Newsmag themes from tagDiv, does not have authorisation in a REST route and does not validate as well as escape some parameters when outputting them back, which could allow unauthenticated users to perform Stored Cross-Site Scripting attacks.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected software

Vendor	Product	Versions
Unknown	tagDiv Composer	< 4.2
tagdiv	tagdiv_composer	< 4.2

References

https://wpscan.com/vulnerability/e6d8216d-ace4-48ba-afca-74da0dc5abb5Exploit, Third Party Advisory
https://wpscan.com/vulnerability/e6d8216d-ace4-48ba-afca-74da0dc5abb5Exploit, Third Party Advisory

Timeline

Published: Sep 11, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-316985.4Bludit v3.14.1 is vulnerable to Stored Cross Site Scripting (XSS) via SVG file on site logo. NOTE: the product's security model is that user CVE-2023-316994.8ChurchCRM v4.5.4 is vulnerable to Reflected Cross-Site Scripting (XSS) via image file.CVE-2023-31704.8The tagDiv Composer WordPress plugin before 4.2, used as a companion by the Newspaper and Newsmag themes from tagDiv, does not validate and CVE-2023-317008.8TP-Link TL-WPA4530 KIT V2 (EU)_170406 and V2 (EU)_161115 is vulnerable to Command Injection via _httpRpmPlcDeviceAdd.CVE-2023-317018.8TP-Link TL-WPA4530 KIT V2 (EU)_170406 and V2 (EU)_161115 is vulnerable to Command Injection via _httpRpmPlcDeviceRemove.CVE-2023-317027.2SQL injection in the View User Profile in MicroWorld eScan Management Console 14.0.1400.2281 allows remote attacker to dump entire database CVE-2023-317039.0Cross Site Scripting (XSS) in the edit user form in Microworld Technologies eScan management console 14.0.1400.2281 allows remote attacker t CVE-2023-317049.8Sourcecodester Online Computer and Laptop Store 1.0 is vulnerable to Incorrect Access Control, which allows remote attackers to elevate priv CVE-2023-317055.4A Reflected Cross-site scripting (XSS) vulnerability in Sourcecodester Task Reminder System 1.0 allows an authenticated user to inject malic CVE-2023-317079.8SEMCMS 1.5 is vulnerable to SQL Injection via Ant_Rponse.php.CVE-2023-317084.3A Cross-Site Request Forgery (CSRF) in EyouCMS v1.6.2 allows attackers to execute arbitrary commands via a supplying a crafted HTML file to CVE-2023-31717.5A flaw was found in EAP-7 during deserialization of certain classes, which permits instantiation of HashMap and HashTable with no checks on