CVE-2026-39692

CVE-2026-39692 is a Stored Cross-Site Scripting (XSS) vulnerability in tagDiv Composer (td-composer) affecting versions 5.4.3 and earlier. This flaw allows improper neutralization of input during web page generation, enabling attackers to inject and store malicious scripts within the application. The vulnerability impacts any organization utilizing this composer tool in their web infrastructure. The vulnerability carries a CVSS score of 6.5 (Medium severity) and requires network access with low attack complexity and user interaction. An authenticated attacker can leverage this vulnerability to execute arbitrary scripts in victims' browsers with limited impact to confidentiality, integrity, and availability. The attack vector is network-based and crosses security boundaries (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L). Current exploitation status indicates minimal community attention and low real-world threat activity. The EPSS score of 0.00034 suggests this vulnerability ranks lower than 98.87 percent of all CVEs in terms of exploitation likelihood. The vulnerability is not listed on the Known Exploited Vulnerabilities catalog and remains inactive on threat tracking lists, indicating no known active exploitation campaigns at this time.