CVE-2026-15101

The WPBakery Page Builder plugin for WordPress (versions up to and including 8.7.4 ) is affected by a Stored Cross-Site Scripting (XSS) vulnerability via the 'data' parameter . The root cause is a sanitization bypass: the wp_kses_post filter applied on save fails to strip the payload because the ...

CVE-2026-12561

The tagDiv Composer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the vcrawhtml shortcode in all versions up to and including 5.4.5. This is due to insufficient input sanitization and output escaping in the vcrawhtml::render method, which base64-decodes shortcode content...

CVE-2026-12561

CVE-2026-12561 affects the tagDiv Composer WordPress plugin in all versions up to and including 5.4.5 . The vulnerability is a Stored Cross-Site Scripting flaw in the vc_raw_html::render() method. The method base64-decodes shortcode content and concatenates the result directly into page HTML with...

CVE-2026-12561 tagDiv Composer <= 5.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting

The tagDiv Composer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the vcrawhtml shortcode in all versions up to and including 5.4.5. This is due to insufficient input sanitization and output escaping in the vcrawhtml::render method, which base64-decodes shortcode content...