{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"tagDiv Composer","vendor":"tagDiv","versions":[{"lessThanOrEqual":"5.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@wordfence.com"},{"affectedData":[{"cpes":["cpe:2.3:a:tagdiv:composer:*:*:*:*:*:wordpress:*:*"],"defaultStatus":"unknown","product":"composer","vendor":"tagdiv","versions":[{"lessThanOrEqual":"5.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:tagdiv:tagdiv_composer:*:*:*:*:*:wordpress:*:*","matchCriteriaId":"FED1C33B-12BC-4681-9EBF-E7E4AB59ED46","versionEndExcluding":"5.1","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"The tagDiv Composer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘envato_code[]’ parameter in all versions up to, and including, 5.0 due to insufficient input sanitization and output escaping within the on_ajax_register_forum_user function. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link."},{"lang":"es","value":"El complemento tagDiv Composer para WordPress es vulnerable a ataques de cross site scripting reflejado a través del parámetro 'envato_code[]' en todas las versiones hasta la 5.0 incluida, debido a una desinfección de entrada insuficiente y al escape de salida dentro de la función on_ajax_register_forum_user. Esto permite que atacantes no autenticados inyecten secuencias de comandos web arbitrarias en páginas que se ejecutan si logran engañar a un usuario para que realice una acción, como hacer clic en un enlace."}],"id":"CVE-2024-5212","lastModified":"2026-06-17T08:15:25.390","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.7,"source":"security@wordfence.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2024-5212","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2024-09-03T18:01:28.147543Z","version":"2.0.3"}}]},"published":"2024-08-31T05:15:13.677","references":[{"source":"security@wordfence.com","tags":["Not Applicable"],"url":"https://tagdiv.com/newspaper/"},{"source":"security@wordfence.com","tags":["Third Party Advisory"],"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/db95415a-5354-498b-8368-58c47d9948de?source=cve"}],"sourceIdentifier":"security@wordfence.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"security@wordfence.com","type":"Secondary"}]}