CVE-2025-50005: 
WordPress vulnerability analysis and mitigation

CVE-2025-50005 is a DOM-Based Cross-Site Scripting (XSS) vulnerability in the tagDiv Composer WordPress plugin (td-composer). It affects all versions of tagDiv Composer up to and including 5.4.2. The vulnerability was reported by Patchstack and published on January 22, 2026. The CNA (Patchstack) assigned a CVSS v3.1 base score of 6.5 (Medium), while an earlier CISA-ADP score of 6.1 (Medium) was subsequently superseded (NVD, Patchstack).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting), specifically manifesting as DOM-Based XSS. In DOM-Based XSS, malicious scripts are injected and executed entirely within the browser's Document Object Model without requiring server-side reflection, making it harder to detect via server-side filtering. Exploitation requires no special privileges (unauthenticated) but does require user interaction — typically a victim clicking a crafted link or visiting a malicious page that triggers the payload within the tagDiv Composer plugin context (NVD, Patchstack).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of a victim's browser session on the affected WordPress site. This can lead to session token theft, credential harvesting, defacement of page content as seen by the victim, or redirection to malicious sites. While availability is not directly impacted, confidentiality and integrity are both affected at a low level due to the scoped nature of DOM-Based XSS (NVD).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported for CVE-2025-50005 as of the available data. The EPSS score is approximately 0.029% (0.000290), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (Feedly).

1. Reconnaissance: Identify WordPress sites using the tagDiv Composer plugin (td-composer) version 5.4.2 or earlier, using tools like WPScan or by inspecting page source for plugin indicators.
2. Craft malicious payload: Construct a URL or page containing a DOM-Based XSS payload targeting the vulnerable input handling within the tagDiv Composer plugin (e.g., a crafted URL parameter or fragment that is unsafely written to the DOM).
3. Deliver payload: Trick a victim user (e.g., a site visitor or administrator) into clicking the crafted link via phishing, social engineering, or embedding it in a comment or external page.
4. Payload execution: When the victim's browser processes the malicious URL, the injected JavaScript executes in the context of the vulnerable WordPress site, enabling session cookie theft, keylogging, or redirection to attacker-controlled infrastructure (NVD).

• Network: Unusual outbound requests from victim browsers to attacker-controlled domains following interaction with tagDiv Composer-powered pages; unexpected cross-origin requests in browser network logs.
• Logs: Web server access logs showing requests with suspicious URL fragments or parameters containing encoded JavaScript (e.g., <script>, javascript:, onerror=) targeting pages rendered by tagDiv Composer.
• Browser/Client-Side: Unexpected JavaScript execution or redirects when visiting pages using the tagDiv Composer plugin; browser console errors related to DOM manipulation on affected pages.

WordPress site administrators should update the tagDiv Composer plugin (td-composer) to a version newer than 5.4.2 that addresses this vulnerability. Until a patch is applied, consider disabling the plugin if it is not essential, or restricting access to affected pages. Implementing a Web Application Firewall (WAF) with XSS filtering rules can provide an additional layer of defense. Monitor the official tagDiv and WordPress plugin repository for patched releases (Patchstack).