CVE-2025-2806

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-2806", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-03-25T21:38:33.432Z", "datePublished": "2025-05-08T11:23:40.588Z", "dateUpdated": "2026-04-08T16:52:53.959Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:52:53.959Z"}, "affected": [{"vendor": "tagDiv", "product": "tagDiv Composer", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "5.3", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The tagDiv Composer plugin for WordPress, used by the Newspaper theme, is vulnerable to Reflected Cross-Site Scripting via the \u2018data\u2019 parameter in all versions up to, and including, 5.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link."}], "title": "tagDiv Composer <= 5.3 - Reflected Cross-Site Scripting via 'data'", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/52bd9946-dccc-427a-9abd-0b7153e7484f?source=cve"}, {"url": "http://localhost:1337/wp-content/plugins/td-composer/legacy/common/wp_booster/td_ajax.php#L2034"}, {"url": "https://tagdiv.com/td_deploy/Newspaper/changed_files_12.6.9_12.7.html"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "baseScore": 6.1, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Truoc Phan"}], "timeline": [{"time": "2025-05-07T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-05-08T13:30:06.908469Z", "id": "CVE-2025-2806", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-08T13:32:26.621Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-2806", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-05-08T13:30:06.908469Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-08T13:32:00.455Z"}}], "cna": {"title": "tagDiv Composer <= 5.3 - Reflected Cross-Site Scripting via 'data'", "credits": [{"lang": "en", "type": "finder", "value": "Truoc Phan"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "tagDiv", "product": "tagDiv Composer", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "5.3"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-05-07T00:00:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/52bd9946-dccc-427a-9abd-0b7153e7484f?source=cve"}, {"url": "http://localhost:1337/wp-content/plugins/td-composer/legacy/common/wp_booster/td_ajax.php#L2034"}, {"url": "https://tagdiv.com/td_deploy/Newspaper/changed_files_12.6.9_12.7.html"}], "descriptions": [{"lang": "en", "value": "The tagDiv Composer plugin for WordPress, used by the Newspaper theme, is vulnerable to Reflected Cross-Site Scripting via the \u2018data\u2019 parameter in all versions up to, and including, 5.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-05-08T11:23:40.588Z"}}}, "cveMetadata": {"cveId": "CVE-2025-2806", "state": "PUBLISHED", "dateUpdated": "2025-05-08T13:32:26.621Z", "dateReserved": "2025-03-25T21:38:33.432Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-05-08T11:23:40.588Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "tagDiv Composer", "vendor": "tagDiv", "versions": [{"lessThanOrEqual": "5.3", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:tagdiv:tagdiv_composer:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "E261E575-704A-4CF9-83E6-CB02D9E23D5C", "versionEndExcluding": "5.4", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The tagDiv Composer plugin for WordPress, used by the Newspaper theme, is vulnerable to Reflected Cross-Site Scripting via the \u2018data\u2019 parameter in all versions up to, and including, 5.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link."}, {"lang": "es", "value": "El complemento tagDiv Composer para WordPress, utilizado por el tema Newspaper, es vulnerable a ataques Cross-Site Scripting Reflejado a trav\u00e9s del par\u00e1metro 'data' en todas las versiones hasta la 5.3 incluida, debido a una depuraci\u00f3n de entrada y un escape de salida insuficientes. Esto permite a atacantes no autenticados inyectar scripts web arbitrarios en p\u00e1ginas que se ejecutan si logran enga\u00f1ar al usuario para que realice una acci\u00f3n, como hacer clic en un enlace."}], "id": "CVE-2025-2806", "lastModified": "2026-06-17T09:07:39.047", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-2806", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-05-08T13:30:06.908469Z", "version": "2.0.3"}}]}, "published": "2025-05-08T12:15:17.457", "references": [{"source": "security@wordfence.com", "tags": ["Broken Link"], "url": "http://localhost:1337/wp-content/plugins/td-composer/legacy/common/wp_booster/td_ajax.php#L2034"}, {"source": "security@wordfence.com", "tags": ["Release Notes"], "url": "https://tagdiv.com/td_deploy/Newspaper/changed_files_12.6.9_12.7.html"}, {"source": "security@wordfence.com", "tags": ["Third Party Advisory"], "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/52bd9946-dccc-427a-9abd-0b7153e7484f?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T20:54:10.118955+00:00", "value": {"mitigation_remediation": ["Upgrade the tagDiv Composer plugin to the latest available version (5.4 or newer) ensuring the vulnerable code path is removed.", "If no upgraded release exists, temporarily deactivate or uninstall the plugin to eliminate the input surface.", "Implement server\u2011side input validation or output escaping for the 'data' parameter, or use a security plugin that enforces strict content sanitization, to reduce the risk of XSS if the plugin remains in use."], "summary": {"action": "Patch Immediately", "impact": "Reflected Cross\u2011Site Scripting that can execute malicious scripts in a victim's browser"}, "threat_synthesis": {"affected_systems": "Customers using the WordPress tagDiv Composer plugin, primarily those running the Newspaper theme, are affected. All releases up to and including version 5.3 are vulnerable. The product is distributed as a WordPress plugin by tagDiv, and the vulnerability applies to any WordPress installation that has the plugin active in those versions.", "description_and_impact": "The vulnerability arises from insufficient input sanitization and output escaping of the 'data' parameter in the tagDiv Composer plugin. Unauthenticated attackers can embed malicious scripts in the parameter, causing the scripts to run when a victim interacts with the crafted URL. The flaw permits arbitrary client\u2011side script execution, which can lead to session hijacking, phishing, or defacement. The weakness is identified as CWE\u201179.", "risk_and_exploitability": "The CVSS score is 6.1, indicating moderate severity. The EPSS score is below 1\u202f%, suggesting a low probability of exploitation so far, and the vulnerability is not listed in the CISA KEV catalog. However, the attack vector is unauthenticated and only requires a user to click a malicious link, making it trivially exploitable from a technical standpoint. Due to the simplicity of the exploit, insiders or attackers relying on user traffic can feasibly spread it. Thus, while exploitation probability is low currently, the impact of successful exploitation is significant."}}}}, "created": "2026-04-21T21:00:36.007934+00:00", "updated": "2026-04-21T21:00:36.007945+00:00", "vendors": []}