# CVE-2023-3169: tagDiv Composer - XSS

> Live exploitation tracking for CVE-2023-3169 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2023-3169

## Key facts

- **Exploitation phase:** Background Noise. Continuous low-level scanning or exploitation attempts are observed, mostly opportunistic and automated.
- **CVSS score:** 6.1
- **Public exploit available:** Yes
- **Affected products:** tagDiv Composer
- **Weaknesses:** CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'))
- **Tags:** wordpress

## Description

The tagDiv Composer WordPress plugin before 4.2, used as a companion by the Newspaper and Newsmag themes from tagDiv, does not have authorisation in a REST route and does not validate as well as escape some parameters when outputting them back, which could allow unauthenticated users to perform Stored Cross-Site Scripting attacks.

## CrowdSec analysis

[CVE-2023-3169](https://euvd.enisa.europa.eu/vulnerability/CVE-2023-3169) is a vulnerability in the tagDiv Composer WordPress plugin prior to version 4.2 that allows unauthenticated users to exploit insufficient authorization and input validation in a REST route, leading to stored cross-site scripting (XSS) attacks. This flaw could enable attackers to inject malicious scripts that execute in the browsers of site visitors, potentially compromising user data and site integrity.

CrowdSec has been tracking this vulnerability and its exploits since 15th of October 2025.

CrowdSec network observations suggest that most exploitation of CVE-2023-3169 involves focused reconnaissance to identify viable targets. Attackers typically tailor their campaigns based on system exposure and configuration. It is unlikely that a given attack is accidental.
In addition, according to the CrowdSec network, attack volume against CVE-2023-3169 has dipped slightly compared to the previous week. Although still commonly targeted, the decline suggests a cooling-off period. Long-term relevance remains, but attention is waning.

Attackers exploit the `/wp-json/tdw/save_css` endpoint by injecting malicious JavaScript into the `compiled_css` parameter, resulting in stored XSS that is triggered when the CSS is loaded on WordPress sites using the tagDiv Composer plugin.

## Timeline

- 2023-09-11: CVE Published. CVE-2023-3169 is published to NVD.
- 2025-10-15: Rule Released. CrowdSec releases a rule to detect CVE-2023-3169 exploitation attempts against the CrowdSec Network.
- 2025-10-16: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2023-3169 for the first time.

## References

- https://wpscan.com/vulnerability/e6d8216d-ace4-48ba-afca-74da0dc5abb5
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-3169.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2023-3169) follows observed exploitation activity for CVE-2023-3169. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.