CVE-2025-3510

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-3510", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-04-10T20:49:20.706Z", "datePublished": "2025-05-02T03:21:18.095Z", "dateUpdated": "2026-04-08T16:43:44.682Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:43:44.682Z"}, "affected": [{"vendor": "tagDiv", "product": "tagDiv Composer", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "5.4", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The tagDiv Composer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple shortcodes in all versions up to, and including, 5.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "tagDiv Composer <= 5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2bd6b66d-f33e-4287-850b-a199de72f6ad?source=cve"}, {"url": "https://tagdiv.com/newspaper-changelog/"}, {"url": "https://themeforest.net/item/newspaper/5489609"}, {"url": "https://tagdiv.com/tagdiv-composer-page-builder-basics/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Matthew Rollings"}], "timeline": [{"time": "2025-05-01T14:50:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-05-02T14:56:21.781998Z", "id": "CVE-2025-3510", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-02T14:57:09.067Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-3510", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-05-02T14:56:21.781998Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-02T14:57:01.880Z"}}], "cna": {"title": "tagDiv Composer <= 5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes", "credits": [{"lang": "en", "type": "finder", "value": "Matthew Rollings"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "tagDiv", "product": "tagDiv Composer", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "5.4"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-05-01T14:50:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2bd6b66d-f33e-4287-850b-a199de72f6ad?source=cve"}, {"url": "https://tagdiv.com/newspaper-changelog/"}, {"url": "https://themeforest.net/item/newspaper/5489609"}, {"url": "https://tagdiv.com/tagdiv-composer-page-builder-basics/"}], "descriptions": [{"lang": "en", "value": "The tagDiv Composer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple shortcodes in all versions up to, and including, 5.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-05-02T03:21:18.095Z"}}}, "cveMetadata": {"cveId": "CVE-2025-3510", "state": "PUBLISHED", "dateUpdated": "2025-05-02T14:57:09.067Z", "dateReserved": "2025-04-10T20:49:20.706Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-05-02T03:21:18.095Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "tagDiv Composer", "vendor": "tagDiv", "versions": [{"lessThanOrEqual": "5.4", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:tagdiv:composer:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "FABC17A1-A297-4E9C-9CFE-C59FD1F4299D", "versionEndExcluding": "5.4.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The tagDiv Composer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple shortcodes in all versions up to, and including, 5.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El complemento tagDiv Composer para WordPress es vulnerable a Cross-Site Scripting Almacenado a trav\u00e9s de m\u00faltiples shortcodes en todas las versiones hasta la 5.4 incluida, debido a una depuraci\u00f3n de entrada insuficiente y al escape de salida en los atributos proporcionados por el usuario. Esto permite a atacantes autenticados, con acceso de colaborador o superior, inyectar scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n al acceder un usuario a una p\u00e1gina inyectada."}], "id": "CVE-2025-3510", "lastModified": "2026-06-17T09:20:04.833", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-3510", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-05-02T14:56:21.781998Z", "version": "2.0.3"}}]}, "published": "2025-05-02T04:15:51.480", "references": [{"source": "security@wordfence.com", "tags": ["Not Applicable"], "url": "https://tagdiv.com/newspaper-changelog/"}, {"source": "security@wordfence.com", "tags": ["Product"], "url": "https://tagdiv.com/tagdiv-composer-page-builder-basics/"}, {"source": "security@wordfence.com", "tags": ["Not Applicable"], "url": "https://themeforest.net/item/newspaper/5489609"}, {"source": "security@wordfence.com", "tags": ["Third Party Advisory"], "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2bd6b66d-f33e-4287-850b-a199de72f6ad?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T14:56:23.705279+00:00", "value": {"mitigation_remediation": ["Update tagDiv Composer to the latest release (5.5 or higher) that contains the XSS fix.", "Manually review existing posts and pages for shortcodes containing suspicious or recently added attributes and remove or sanitize them.", "Audit contributor and higher\u2011level user accounts; restrict or revoke such privileges from users who do not require them, and consider re\u2011assigning roles to limit the attack surface."], "summary": {"action": "Immediate Patch", "impact": "Stored Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "WordPress sites that use the tagDiv Composer plugin up to and including version 5.4 are susceptible. The weakness applies to all user roles that can create or edit content, specifically contributors and higher. The affected plugin is named tagDiv Composer, provided by the vendor tagDiv.", "description_and_impact": "The tagDiv Composer plugin for WordPress contains a stored cross\u2011site scripting flaw caused by inadequate sanitization and output escaping of user\u2011supplied shortcode attributes. An attacker with contributor\u2011level or higher access can insert malicious scripts that are permanently stored and executed whenever a page containing the affected shortcode is viewed by any user. The impact includes defacement, theft of session cookies, and arbitrary script execution on the victim\u2019s browser.", "risk_and_exploitability": "The CVSS score is 6.4, indicating moderate severity. The EPSS score is below 1%, suggesting low likelihood of widespread exploitation at this time, and the vulnerability is not listed in CISA\u2019s KEV catalog. The attack requires authenticated access with contributor privileges, so it is limited to users who have been granted such permissions. Once the injected code is embedded, any visitor to the compromised page will be exposed to the attacker\u2019s script, which can facilitate additional attacks such as session hijacking or credential disclosure."}}}}, "created": "2026-04-22T15:00:05.628863+00:00", "updated": "2026-04-22T15:00:05.628876+00:00", "vendors": []}