CVE-2025-2804 Overview
CVE-2025-2804 is a Reflected Cross-Site Scripting (XSS) vulnerability in the tagDiv Composer plugin for WordPress, which is bundled with the Newspaper theme. The flaw affects all versions up to and including 5.3. It stems from insufficient input sanitization and output escaping in the account_id and account_username parameters. Unauthenticated attackers can inject arbitrary web scripts that execute when a victim clicks a crafted link. The issue is tracked under [CWE-79] (Improper Neutralization of Input During Web Page Generation).
Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in a victim's browser session by luring the user to a crafted URL, potentially leading to session theft, credential harvesting, or redirection to attacker-controlled resources.
Affected Products
- tagDiv Composer plugin for WordPress (all versions ≤ 5.3)
- WordPress sites using the Newspaper theme that bundles tagDiv Composer
- Any WordPress deployment with tagDiv Composer active on public-facing pages
Discovery Timeline
- 2025-03-28 - CVE-2025-2804 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-2804
Vulnerability Analysis
The vulnerability is a Reflected Cross-Site Scripting flaw in the tagDiv Composer plugin. The plugin accepts the account_id and account_username request parameters and reflects their values back into rendered HTML without adequate sanitization or contextual output escaping. Because the reflection occurs in an HTML context, an attacker can inject <script> tags or event-handler attributes that the victim's browser will execute.
Exploitation requires user interaction — the target must click a malicious link or visit an attacker-controlled page that triggers the request. No authentication is required, and the attack traverses a browser trust boundary, allowing scripts to run in the security context of the vulnerable WordPress site.
Successful exploitation can lead to session cookie theft, forced actions performed as the victim, phishing content injection, or redirection to malware distribution sites. Administrator accounts are the most valuable targets, as script execution in their context can facilitate site takeover.
Root Cause
The root cause is missing input validation and missing output escaping when the plugin renders values received from account_id and account_username query parameters. User-controlled input reaches the HTTP response body without being processed by functions such as esc_html(), esc_attr(), or wp_kses().
Attack Vector
The attack vector is network-based and depends on social engineering. An attacker crafts a URL to the vulnerable WordPress site that includes a JavaScript payload inside the account_id or account_username parameter. The attacker then delivers the URL via email, chat, social media, or a malicious page. When the victim opens the link, the payload executes in their browser under the origin of the affected WordPress site.
The vulnerability manifests when the plugin echoes the parameter values into the HTML response without escaping. See the Wordfence Vulnerability Report for technical details.
Detection Methods for CVE-2025-2804
Indicators of Compromise
- HTTP requests to WordPress pages containing account_id or account_username parameters with HTML tags, <script> fragments, javascript: URIs, or encoded equivalents such as %3Cscript%3E.
- Referrer headers or access logs showing external sites directing traffic to URLs with suspicious query strings targeting the tagDiv Composer plugin.
- Unexpected outbound requests from user browsers to attacker-controlled domains after visiting affected pages.
Detection Strategies
- Inspect web server access logs for query strings containing common XSS payload markers (<script, onerror=, onload=, alert(, document.cookie).
- Deploy a Web Application Firewall (WAF) rule that flags requests to WordPress endpoints where account_id or account_username values contain HTML metacharacters.
- Correlate reflected XSS attempts with subsequent authentication events from the same source IP to identify session hijacking follow-up activity.
Monitoring Recommendations
- Enable Content Security Policy (CSP) reporting to capture blocked inline script execution attempts on WordPress front-end pages.
- Monitor administrator session activity for anomalies such as new sessions from unfamiliar geolocations following link clicks.
- Alert on plugin file integrity changes and unexpected administrative account creation, which can follow successful XSS-to-takeover chains.
How to Mitigate CVE-2025-2804
Immediate Actions Required
- Update the tagDiv Composer plugin and the Newspaper theme to the latest release published by tagDiv that addresses this vulnerability. Refer to the TagDiv Change Log for version information.
- Audit administrator accounts and force password resets on any account that may have followed suspicious links during the exposure window.
- Invalidate active WordPress sessions to purge any hijacked session cookies.
Patch Information
Upgrade tagDiv Composer beyond version 5.3 to a release that sanitizes the account_id and account_username parameters. Consult the vendor changelog and the Wordfence Vulnerability Report to confirm the fixed version applicable to your Newspaper theme installation.
Workarounds
- Deploy a WAF rule that blocks or sanitizes requests containing HTML or script metacharacters in the account_id and account_username parameters until patching is complete.
- Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins, limiting the impact of reflected payloads.
- Restrict administrative access to trusted IP ranges to reduce the likelihood of privileged accounts being targeted through phishing links.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
