CVE-2025-2806: Tagdiv Composer XSS Vulnerability

CVE-2025-2806 Overview

CVE-2025-2806 is a Reflected Cross-Site Scripting (XSS) vulnerability affecting the tagDiv Composer plugin for WordPress, which ships with the widely deployed Newspaper theme. The flaw resides in the handling of the data parameter and stems from insufficient input sanitization and output escaping [CWE-79]. Unauthenticated attackers can inject arbitrary JavaScript that executes in a victim's browser when the victim clicks a crafted link. All versions of tagdiv_composer up to and including 5.3 are affected.

Critical Impact
Successful exploitation allows unauthenticated attackers to execute arbitrary scripts in the browsers of users visiting a maliciously crafted URL, enabling session theft, credential harvesting, and administrative action hijacking.

Affected Products

tagDiv Composer plugin for WordPress, versions up to and including 5.3
WordPress sites using the Newspaper theme by tagDiv
Any WordPress installation bundling td-composer legacy AJAX handlers

Discovery Timeline

2025-05-08 - CVE-2025-2806 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-2806

Vulnerability Analysis

The vulnerability is a Reflected Cross-Site Scripting flaw in the tagDiv Composer plugin. The data parameter passed to the plugin's AJAX endpoint is reflected in the HTTP response without adequate sanitization or output escaping. An attacker crafts a URL containing malicious JavaScript in the data parameter and lures a victim into clicking it. When the target site processes the request, the injected payload is returned and executed in the victim's browser under the origin of the vulnerable site.

Because the flaw requires user interaction and exists in a component with a changed scope, an attacker can pivot from the vulnerable endpoint to affect resources the browser trusts. Successful exploitation enables session cookie theft, forced administrative actions, malicious redirects, and drive-by malware delivery through the trusted site.

Root Cause

The root cause is missing input sanitization and improper output encoding when reflecting the data parameter received by the plugin's AJAX handler (td_ajax.php). User-controlled input is placed into the response context without HTML entity encoding or context-aware escaping, allowing HTML and JavaScript to break out of the intended data context.

Attack Vector

Exploitation occurs over the network without authentication but requires user interaction. An attacker distributes a crafted link, typically via phishing email, social media, or malicious advertising, that targets the vulnerable AJAX endpoint with a JavaScript payload in the data query parameter. When an authenticated administrator clicks the link, the payload runs with the privileges of the victim's session on the WordPress site.

The vulnerability manifests in the reflected response of the plugin's AJAX handler. Refer to the Wordfence Vulnerability Analysis for technical details on the affected code path.

Detection Methods for CVE-2025-2806

Indicators of Compromise

HTTP requests to td_ajax.php containing data parameter values with HTML tags, <script> fragments, javascript: URIs, or common XSS payload signatures such as onerror=, onload=, or alert(
Referer headers pointing to attacker-controlled domains directing users to the plugin AJAX endpoint
Unexpected outbound connections from administrator browsers to unfamiliar hosts shortly after visiting the WordPress site
Creation of new administrator accounts or plugin installations initiated from legitimate admin sessions without corresponding user activity

Detection Strategies

Deploy Web Application Firewall (WAF) rules that inspect the data parameter on requests to /wp-content/plugins/td-composer/ endpoints for encoded script content
Correlate WordPress wp-admin privileged actions with preceding requests to the tagDiv Composer AJAX handler containing suspicious payloads
Alert on reflected response bodies from the plugin endpoint that contain user-supplied <script> or event handler content

Monitoring Recommendations

Enable WordPress audit logging to capture administrative actions and correlate with browser telemetry
Ingest web server access logs into a SIEM and query for anomalous data parameter values targeting td_ajax.php
Monitor DNS and proxy logs for connections to newly registered domains referenced in phishing lures targeting site administrators

How to Mitigate CVE-2025-2806

Immediate Actions Required

Update the tagDiv Composer plugin and Newspaper theme to the latest fixed release provided by tagDiv, referencing the TagDiv Change Log 12.6.9 to 12.7
Force a logout of active WordPress administrator sessions and rotate authentication cookies and passwords after patching
Review recent administrator activity for unauthorized plugin installations, user creations, or content modifications

Patch Information

tagDiv addressed the vulnerability in an updated Newspaper theme release. Site operators should install the vendor-supplied update that supersedes tagDiv Composer 5.3. Consult the vendor changelog and the Wordfence Vulnerability Analysis for verified fix version details.

Workarounds

Restrict access to /wp-content/plugins/td-composer/legacy/common/wp_booster/td_ajax.php at the web server or WAF layer until patching is complete
Deploy a strict Content-Security-Policy header that disallows inline scripts and unauthorized script sources to reduce reflected XSS impact
Educate administrators to avoid clicking untrusted links while authenticated to the WordPress admin console

bash

# Example nginx rule blocking script-like content in the data parameter
location ~* /wp-content/plugins/td-composer/.*\.php$ {
    if ($arg_data ~* "(<|%3C)script|javascript:|onerror=|onload=") {
        return 403;
    }
}