PT-2023-7564 · Tagdiv · Tagdiv Composer Plugin

Truoc Phan · Published 2023-09-11 · Updated 2025-09-24 · CVE-2023-3169

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions tagDiv Composer Plugin versions prior to 4.2

Description The issue exists due to the lack of proper validation and escaping of certain parameters, which could allow unauthenticated users to perform Stored Cross-Site Scripting attacks. This is because the plugin does not have authorization in a REST route and does not properly validate and escape some parameters when outputting them back.

Recommendations For versions prior to 4.2, update to version 4.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the REST route until a patch is available. Avoid using the vulnerable plugin until the issue is resolved.

Exploit

Fix

Special Elements Injection

Improper Neutralization

XSS

Weakness Enumeration

CWE-74

CWE-707

CWE-79

Related Identifiers

BDU:2023-08620

CVE-2023-3169

Affected Products

Tagdiv Composer Plugin

References · 9

• 🔥 https://wpscan.com/vulnerability/e6d8216d-ace4-48ba-afca-74da0dc5abb5 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-3169 · Security Note
• https://osv.dev/vulnerability/CVE-2023-3169 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-08620 · Security Note
• https://t.me/cvenotify/57986 · Telegram Post
• https://twitter.com/pdnuclei_bot/status/1970926236051399073 · Twitter Post
• https://t.me/cvenotify/96162 · Telegram Post
• https://twitter.com/CVEnew/status/1701323269771821196 · Twitter Post
• https://vuldb.com/ru/?id.239423 · Note