CVE-2025-1705

The tagDiv Composer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.3. This is due to missing or incorrect nonce validation within the td_ajax_get_views AJAX action. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

• CWE-79

• https://tagdiv.com/newspaper-changelog/
• https://tagdiv.com/tagdiv-composer-page-builder-basics/
• https://themeforest.net/item/newspaper/5489609
• https://www.wordfence.com/threat-intel/vulnerabilities/id/2aaa8c34-cf7b-4630-adc8-cbb534deff89?source=cve

Published

Mar 28, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-1699An incorrect default permissions vulnerability was reported …2.8
• CVE-2025-1700A DLL hijacking vulnerability was reported in the Motorola S…7.1
• CVE-2025-1701CVE-2025-1701 is a high-severity vulnerability in the MIM Ad…8.9
• CVE-2025-1702The Ultimate Member – User Profile, Registration, Login, Mem…7.5
• CVE-2025-1703The Ultimate Blocks plugin for WordPress is vulnerable to St…6.4
• CVE-2025-1704ComponentInstaller Modification in ComponentInstaller in Goo…6.5
• CVE-2025-1706Software installed and run as a non-privileged user may cond…7.5
• CVE-2025-1707The Review Schema plugin for WordPress is vulnerable to Loca…8.8
• CVE-2025-1708The application is vulnerable to SQL injection attacks. An a…7.5
• CVE-2025-1709Several credentials for the local PostgreSQL database are st…6.5
• CVE-2025-1710The maxView Storage Manager does not implement sufficient me…9.8
• CVE-2025-1711Multiple services of the DUT as well as different scopes of …7.5