CVE-2025-1705: tagDiv Composer WordPress CSRF Vulnerability

CVE-2025-1705 Overview

CVE-2025-1705 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the tagDiv Composer plugin for WordPress in all versions up to and including 5.3. The flaw stems from missing or incorrect nonce validation within the td_ajax_get_views AJAX action. Unauthenticated attackers can inject malicious web scripts by tricking a site administrator into clicking a crafted link, chaining CSRF with stored Cross-Site Scripting [CWE-79]. The tagDiv Composer plugin ships with the popular Newspaper theme, expanding the potential attack surface across WordPress sites that rely on this page builder.

Critical Impact
Successful exploitation allows unauthenticated attackers to inject malicious scripts into a WordPress site when an administrator is lured into clicking an attacker-controlled link, leading to potential session hijacking, content manipulation, or administrative account takeover.

Affected Products

tagDiv Composer plugin for WordPress (all versions ≤ 5.3)
WordPress sites bundling the tagDiv Composer with the Newspaper theme
WordPress sites using tagDiv Composer as a standalone page builder

Discovery Timeline

2025-03-28 - CVE-2025-1705 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-1705

Vulnerability Analysis

The vulnerability resides in the td_ajax_get_views AJAX action handler exposed by the tagDiv Composer plugin. WordPress plugins use nonces to validate that requests to privileged actions originate from legitimate user interactions. The affected handler either omits nonce verification or implements it incorrectly, allowing forged requests to reach sensitive code paths. Because the vulnerability enables script injection through the forged request, an attacker can combine CSRF with reflected or stored Cross-Site Scripting [CWE-79]. This category of flaw is often used to escalate from unauthenticated access to persistent site compromise when administrators are targeted.

Root Cause

The root cause is missing or incorrect use of the WordPress nonce API within the td_ajax_get_views AJAX endpoint. Functions such as check_ajax_referer() or wp_verify_nonce() are either absent or improperly invoked. Without a valid, request-bound token, the plugin cannot distinguish between an intentional administrative action and a request forged by a third-party site.

Attack Vector

Exploitation requires user interaction. An attacker hosts a malicious page or sends a link containing a crafted payload targeting the td_ajax_get_views action on the victim WordPress site. When an authenticated administrator visits the attacker-controlled resource, the browser submits the forged request under the administrator's session. The plugin processes the request without validating a nonce, allowing injected script content to be reflected or persisted. Subsequent visitors executing the injected script may leak session cookies, admin tokens, or trigger further privileged actions.

No public proof-of-concept code has been released. See the Wordfence Vulnerability ID 2aaa8c34 advisory for technical detail.

Detection Methods for CVE-2025-1705

Indicators of Compromise

Unexpected POST or GET requests to admin-ajax.php referencing action=td_ajax_get_views from external referrers
New or modified WordPress posts, widgets, or options containing <script> tags or JavaScript event handlers
Administrator sessions initiating unusual outbound requests immediately after clicking external links
Web server logs showing high volumes of td_ajax_get_views requests without matching _wpnonce parameters

Detection Strategies

Inspect HTTP access logs for cross-origin requests to admin-ajax.php invoking tagDiv Composer AJAX actions
Deploy WordPress security plugins or a web application firewall (WAF) with rules targeting Wordfence Vulnerability ID 2aaa8c34
Audit the WordPress wp_posts, wp_options, and wp_postmeta tables for suspicious script payloads inserted after the vulnerability window
Correlate administrator browsing activity with subsequent site content changes to identify CSRF-driven modifications

Monitoring Recommendations

Enable request logging on admin-ajax.php and alert on requests missing valid nonce parameters
Monitor administrator accounts for anomalous activity, including content changes originating from external referers
Track plugin version metadata across managed WordPress fleets to flag installations still running tagDiv Composer ≤ 5.3

How to Mitigate CVE-2025-1705

Immediate Actions Required

Upgrade the tagDiv Composer plugin to a version later than 5.3 once a vendor patch is confirmed via the TagDiv Changelog
Instruct administrators to log out of WordPress sessions before browsing untrusted content
Deploy a web application firewall rule blocking cross-origin requests to the td_ajax_get_views action
Review recent content, widgets, and plugin options for injected script payloads and remove any unauthorized modifications

Patch Information

Refer to the TagDiv Changelog for release notes covering versions after 5.3. Administrators using the Newspaper theme from ThemeForest should ensure both the theme and bundled tagDiv Composer plugin are updated together. Additional advisory context is available from Wordfence Vulnerability ID 2aaa8c34.

Workarounds

Restrict administrator access to the WordPress dashboard using IP allowlisting or VPN-only access until the plugin is patched
Implement a Content Security Policy (CSP) that limits inline script execution to reduce XSS payload impact
Use browser session isolation for administrative work, keeping WordPress administration in a dedicated browser profile
Temporarily disable the tagDiv Composer plugin if the page builder functionality is not actively required

bash

# Example WAF rule concept blocking cross-origin td_ajax_get_views requests
# Adjust for your WAF or reverse proxy syntax
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
  "chain,deny,status:403,id:1705001,msg:'Block CSRF against tagDiv Composer td_ajax_get_views'"
SecRule ARGS:action "@streq td_ajax_get_views" "chain"
SecRule REQUEST_HEADERS:Referer "!@beginsWith https://your-wordpress-site.example"