CVE-2022-3477: critical vulnerability in tagDiv Composer
tagDiv Composer < 3.5 - Unauthenticated Account Takeover
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
65Vexday Risk Score
Patch now. It exploitation observed by VulnCheck and has a working public exploit.
ssvc Actcvss 9.8epss 4.0%
from disclosure to weapon
Published on NVDNov 14
VulnCheckOct 24
The tagDiv Composer WordPress plugin before 3.5, required by the Newspaper WordPress theme before 12.1 and Newsmag WordPress theme before 5.2.2, does not properly implement the Facebook login feature, allowing unauthenticated attackers to login as any user by just knowing their email address
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Related CVEs — tagDiv Composer
In the same product, most dangerous first.
CVE-2024-13645CRITICALTagDiv Composer <= 5.3 - Unauthenticated Arbitrary PHP Object InstantiationEPSS 0.7%CVE-2024-3813HIGHtagDiv Composer <= 4.8 - Authenticated (Contributor+) Local File Inclusion via ShortcodeEPSS 0.7%CVE-2024-3886MEDIUMtagDiv Composer <= 5.0 - Reflected Cross-Site Scripting via envato_code[]EPSS 0.4%CVE-2025-1705MEDIUMtagDiv Composer <= 5.3 - Cross-Site Request Forgery to Stored Cross-Site ScriptingEPSS 0.4%CVE-2024-5212MEDIUMtagDiv Composer <= 5.0 - Reflected Cross-Site Scripting via envato_code[]EPSS 0.4%CVE-2025-2806MEDIUMtagDiv Composer <= 5.3 - Reflected Cross-Site Scripting via 'data'EPSS 0.3%