{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-2804", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-03-25T21:34:03.548Z", "datePublished": "2025-03-28T05:23:44.516Z", "dateUpdated": "2026-04-08T16:48:48.636Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:48:48.636Z"}, "affected": [{"vendor": "tagDiv", "product": "tagDiv Composer", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "5.3", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The tagDiv Composer plugin for WordPress, used by the Newspaper theme, is vulnerable to Reflected Cross-Site Scripting via the 'account_id' and 'account_username' parameters in all versions up to, and including, 5.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link."}], "title": "tagDiv Composer <= 5.3 - Reflected Cross-Site Scripting via 'account_id' and 'account_username'", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/41ef545a-7de1-406c-8686-57216e697a1b?source=cve"}, {"url": "https://tagdiv.com/td_deploy/Newspaper/changed_files_12.6.9_12.7.html"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "baseScore": 6.1, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Truoc Phan"}], "timeline": [{"time": "2025-03-27T16:33:57.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-03-28T14:35:49.548742Z", "id": "CVE-2025-2804", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-28T14:35:58.805Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-2804", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-03-28T14:35:49.548742Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-28T14:35:54.093Z"}}], "cna": {"title": "tagDiv Composer <= 5.3 - Reflected Cross-Site Scripting via 'account_id' and 'account_username'", "credits": [{"lang": "en", "type": "finder", "value": "Truoc Phan"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "tagDiv", "product": "tagDiv Composer", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "5.3"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-03-27T16:33:57.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/41ef545a-7de1-406c-8686-57216e697a1b?source=cve"}, {"url": "https://tagdiv.com/td_deploy/Newspaper/changed_files_12.6.9_12.7.html"}], "descriptions": [{"lang": "en", "value": "The tagDiv Composer plugin for WordPress, used by the Newspaper theme, is vulnerable to Reflected Cross-Site Scripting via the 'account_id' and 'account_username' parameters in all versions up to, and including, 5.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:48:48.636Z"}}}, "cveMetadata": {"cveId": "CVE-2025-2804", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:48:48.636Z", "dateReserved": "2025-03-25T21:34:03.548Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-03-28T05:23:44.516Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The tagDiv Composer plugin for WordPress, used by the Newspaper theme, is vulnerable to Reflected Cross-Site Scripting via the 'account_id' and 'account_username' parameters in all versions up to, and including, 5.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link."}, {"lang": "es", "value": "El complemento tagDiv Composer para WordPress, utilizado por el tema Newspaper, es vulnerable a ataques Cross-Site Scripting Reflejado a trav\u00e9s de los par\u00e1metros 'account_id' y 'account_username' en todas las versiones hasta la 5.3 incluida, debido a una depuraci\u00f3n de entrada y al escape de salida insuficiente. Esto permite a atacantes no autenticados inyectar scripts web arbitrarios en p\u00e1ginas que se ejecutan si logran enga\u00f1ar al usuario para que realice una acci\u00f3n, como hacer clic en un enlace."}], "id": "CVE-2025-2804", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}]}, "published": "2025-03-28T06:15:34.157", "references": [{"source": "security@wordfence.com", "url": "https://tagdiv.com/td_deploy/Newspaper/changed_files_12.6.9_12.7.html"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/41ef545a-7de1-406c-8686-57216e697a1b?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T21:38:01.063494+00:00", "value": {"mitigation_remediation": ["Upgrade the tagDiv Composer plugin to the latest version released after 5.3, which removes the unsanitized input handling. ", "If an immediate upgrade is not possible, disable the 'account_id' and 'account_username' query parameters on the affected pages by removing or sanitizing them in the theme or via custom code. ", "Consider disabling the tagDiv Composer plugin entirely until a patch is applied, and review any custom scripts that interact with these parameters for proper escaping."], "summary": {"action": "Patch now", "impact": "Reflected Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "This vulnerability affects all releases of the tagDiv Composer plugin up to and including version 5.3. The plugin is commonly bundled with the Newspaper theme on WordPress sites. Users running any of these versions are exposed to the flaw unless they update to a patched release beyond 5.3.", "description_and_impact": "The tagDiv Composer plugin for WordPress contains a reflected cross\u2011site scripting flaw that permits unauthenticated attackers to inject user\u2011controlled scripts via the 'account_id' and 'account_username' parameters. These parameters are exposed in the URL and the plugin fails to apply proper input sanitization or output escaping. The flaw allows an attacker to embed arbitrary scripts that will run in the victim's browser when the user clicks a crafted link or visits a malicious URL, leading to theft of credentials, session hijacking or malicious content injection. The weakness is a classic input validation flaw (CWE\u201179).", "risk_and_exploitability": "The CVSS score of 6.1 indicates a moderate severity. The EPSS score of less than 1 percent shows a low probability of exploitation in the wild, and the flaw is not listed in the CISA KEV catalogue. Attackers can trigger the exploit by delivering a crafted URL containing malicious payloads in the 'account_id' or 'account_username' parameters and luring a user to click it. Successful exploitation would only affect the victim\u2019s browser session and does not allow direct code execution on the server."}}}}, "created": "2026-04-21T21:45:25.844291+00:00", "updated": "2026-04-21T21:45:25.844302+00:00", "vendors": []}