CVE-2025-50001: tagDiv Composer XSS Vulnerability

CVE-2025-50001 Overview

CVE-2025-50001 is a reflected Cross-Site Scripting (XSS) vulnerability in the tagDiv Composer (td-composer) WordPress plugin. The flaw affects all versions up to and including 5.4.2. It stems from improper neutralization of user-supplied input during web page generation, classified under [CWE-79]. An unauthenticated attacker can craft a malicious URL that, when visited by a victim, executes arbitrary JavaScript in the victim's browser session. The vulnerability has an EPSS score of 0.039% as of May 2026, indicating a low probability of exploitation activity at this time.

Critical Impact
A successful attack executes attacker-controlled JavaScript in the victim's browser context, enabling session theft, credential harvesting, or redirection to malicious sites. Exploitation requires user interaction with a crafted link.

Affected Products

tagDiv Composer (td-composer) WordPress plugin versions up to and including 5.4.2
WordPress sites bundling the tagDiv Composer plugin
Themes from tagDiv that depend on the Composer plugin

Discovery Timeline

2026-03-19 - CVE-2025-50001 published to NVD
2026-04-29 - Last updated in NVD database

Technical Details for CVE-2025-50001

Vulnerability Analysis

The vulnerability is a reflected XSS issue in the tagDiv Composer plugin for WordPress. The plugin processes request parameters and reflects them back into the generated HTML response without applying proper output encoding or input sanitization. An attacker constructs a URL containing a JavaScript payload in a vulnerable parameter and delivers it to a target via phishing, social media, or other social engineering channels.

When the victim loads the crafted URL, the unsanitized payload is rendered in the response body and executed by the browser. The attack runs in the security context of the WordPress site, granting access to cookies, the Document Object Model (DOM), and authenticated session state. Because the scope changes between the vulnerable component and the impacted resource, the payload can affect resources beyond the immediate request handler.

Root Cause

The root cause is the failure to neutralize special characters in user-controlled input before embedding it into HTTP response content. The plugin does not apply context-aware escaping functions such as WordPress's esc_html(), esc_attr(), or wp_kses() before reflecting parameters back to the response.

Attack Vector

Exploitation requires network access and user interaction. The attacker delivers a malicious link to a victim who is visiting or authenticated to a site running the vulnerable plugin. No prior privileges are required on the target system. The payload executes in the victim's browser and can perform any action the victim is authorized to perform on the site, including issuing administrative requests if the victim is a privileged user.

The vulnerability is described in detail in the Patchstack Security Advisory.

Detection Methods for CVE-2025-50001

Indicators of Compromise

HTTP requests to tagDiv Composer endpoints containing URL-encoded <script> tags, javascript: URIs, or HTML event handlers such as onerror= and onload=
Unexpected outbound requests from authenticated administrator browsers to attacker-controlled domains following clicks on inbound links
Web server access logs showing query strings with reflected payload patterns originating from external referrers

Detection Strategies

Inspect WordPress access logs for query parameters containing HTML or JavaScript metacharacters directed at tagDiv Composer routes
Deploy Web Application Firewall (WAF) rules that flag reflected XSS payload signatures in inbound requests
Correlate referrer headers with social media or email gateways to identify phishing-driven traffic targeting the vulnerable plugin

Monitoring Recommendations

Enable Content Security Policy (CSP) reporting to capture inline script execution attempts and external resource violations
Monitor administrator session activity for anomalous API calls following navigation to externally referred URLs
Track installed plugin inventory and alert on WordPress sites running tagDiv Composer at version 5.4.2 or earlier

How to Mitigate CVE-2025-50001

Immediate Actions Required

Identify all WordPress installations running tagDiv Composer and verify the plugin version against 5.4.2
Apply the vendor-supplied update once available, or disable the plugin until a fixed version is installed
Educate administrators and editors to avoid clicking unsolicited links pointing to their own WordPress site

Patch Information

Review the Patchstack Security Advisory for vendor remediation guidance. Upgrade tagDiv Composer to a version newer than 5.4.2 when published by tagDiv. Until a patched release is available, the plugin should be deactivated on production sites.

Workarounds

Deploy a WAF ruleset that blocks requests containing reflected XSS payload patterns targeting tagDiv Composer endpoints
Implement a strict Content Security Policy (CSP) that disallows inline script execution and restricts script sources to trusted origins
Restrict administrative access to the WordPress dashboard using IP allowlists or VPN-only access to reduce the impact of a successful attack against privileged users

bash

# Example WAF rule (ModSecurity) to block reflected XSS payloads on td-composer endpoints
SecRule REQUEST_URI "@contains td-composer" \
    "chain,deny,status:403,id:1005001,msg:'Blocked potential XSS targeting tagDiv Composer (CVE-2025-50001)'"
    SecRule ARGS "@rx (?i)(<script|javascript:|onerror=|onload=)" "t:urlDecodeUni,t:htmlEntityDecode"