CVE-2026-39712

CVE-2026-39712 is a Cross-Site Scripting (XSS) vulnerability affecting tagDiv Composer versions 5.4.3 and earlier, which stems from improper neutralization of script-related HTML tags in web pages. This vulnerability allows attackers to inject malicious code into the application, potentially compromising the integrity of affected websites and user data. The flaw exists in the tagDiv Composer plugin, a widely-used content creation tool. The vulnerability carries a CVSS score of 5.3 (Medium severity) with a network-based attack vector requiring no authentication or user interaction. The attack has low complexity and results in information integrity impacts without affecting confidentiality or availability. While the immediate severity is moderate, the ease of exploitation over the network without prerequisites makes this a concern for organizations using affected versions. There is currently no evidence of active exploitation in the wild, as the vulnerability is not listed on the KEV catalog and remains inactive on threat intelligence lists. The EPSS score of 0.0005 indicates minimal exploitation probability relative to other CVEs. However, organizations running tagDiv Composer should prioritize upgrading beyond version 5.4.3 to mitigate potential XSS-based attacks targeting their web applications.