CVE-2024-5212: tagDiv Composer XSS Vulnerability

CVE-2024-5212 Overview

CVE-2024-5212 is a Reflected Cross-Site Scripting (XSS) vulnerability in the tagDiv Composer plugin for WordPress. The flaw affects all versions up to and including 5.0. It resides in the on_ajax_register_forum_user function, which fails to properly sanitize input or escape output for the envato_code[] parameter. Unauthenticated attackers can inject arbitrary web scripts into pages. Execution requires tricking a user into clicking a crafted link. The vulnerability is tracked as [CWE-79] Improper Neutralization of Input During Web Page Generation.

Critical Impact
Successful exploitation enables session hijacking, credential theft, and unauthorized actions performed in the context of authenticated WordPress users, including administrators.

Affected Products

tagDiv Composer plugin for WordPress, all versions through 5.0
WordPress installations bundling the tagDiv Composer with Newspaper or Newsmag themes
Sites exposing the plugin's AJAX registration endpoint to unauthenticated visitors

Discovery Timeline

2024-08-31 - CVE-2024-5212 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-5212

Vulnerability Analysis

The vulnerability exists in the on_ajax_register_forum_user function of the tagDiv Composer plugin. This function processes AJAX requests tied to forum user registration and accepts the envato_code[] request parameter. The plugin reflects the supplied value back to the client without proper sanitization or output encoding. Because the endpoint is reachable without authentication, an attacker only needs a victim to load a crafted URL. When the payload renders in the victim's browser, arbitrary JavaScript executes under the vulnerable site's origin. Attackers commonly use this class of flaw to steal session cookies, hijack authenticated sessions, or perform administrative actions through forged requests.

Root Cause

The root cause is insufficient input validation and missing output escaping within on_ajax_register_forum_user. The handler treats the envato_code[] array parameter as trusted data. It writes the value into the HTTP response without applying WordPress escaping functions such as esc_html(), esc_attr(), or wp_kses(). This omission allows raw HTML and JavaScript to flow from request to response.

Attack Vector

Exploitation is remote and requires user interaction. An attacker crafts a URL targeting the plugin's AJAX endpoint with a malicious payload inside the envato_code[] parameter. The victim must click the link or visit an attacker-controlled page that triggers the request. The scope change indicates that the injected script can affect resources beyond the vulnerable component, including authenticated administrative sessions on the same origin.

No verified public proof-of-concept code is available. See the Wordfence Vulnerability Report #db95415a for advisory details.

Detection Methods for CVE-2024-5212

Indicators of Compromise

HTTP requests to WordPress admin-ajax.php referencing the register_forum_user action with suspicious payloads in the envato_code[] parameter
URL-encoded <script>, onerror=, or javascript: sequences appearing in referrer logs or WAF telemetry for tagDiv Composer endpoints
Unusual outbound requests from user browsers to attacker-controlled domains following visits to tagDiv-powered pages

Detection Strategies

Inventory WordPress deployments and identify sites running tagDiv Composer version 5.0 or earlier using plugin fingerprinting
Inspect web server access logs for AJAX requests containing HTML tags, event handlers, or encoded script markers in the envato_code[] parameter
Deploy a web application firewall rule matching reflected XSS signatures against the vulnerable endpoint

Monitoring Recommendations

Enable content security policy (CSP) reporting to capture blocked inline script executions on affected sites
Correlate WordPress administrator session anomalies with prior visits to malformed AJAX URLs
Alert on repeated 200-status responses to the register_forum_user action from a single source IP

How to Mitigate CVE-2024-5212

Immediate Actions Required

Upgrade the tagDiv Composer plugin to a version later than 5.0 as soon as the vendor publishes a fix
Restrict access to the WordPress admin-ajax.php endpoint from untrusted networks where feasible
Force password resets for administrator accounts if suspicious activity is observed in access logs
Instruct users to avoid clicking untrusted links referencing the affected WordPress site

Patch Information

Refer to the Wordfence Vulnerability Report #db95415a for remediation guidance and the tagDiv Newspaper Overview for vendor update channels. Administrators should track vendor release notes and apply the fixed version once available.

Workarounds

Deploy a WAF rule that blocks requests containing HTML metacharacters in the envato_code[] parameter
Add a Content-Security-Policy header that disallows inline scripts to reduce reflected XSS impact
Temporarily disable the tagDiv Composer forum registration functionality if it is not required

bash

# Example nginx rule to block script payloads in the vulnerable parameter
if ($args ~* "envato_code(\[\])?=.*(<script|onerror=|javascript:)") {
    return 403;
}