The tagDiv Composer plugin for WordPress contains a Cross‑Site Request Forgery flaw in the td_ajax_get_views AJAX action. Because the plugin omits correct nonce validation, an unauthenticated attacker can build a forged request that, if a site administrator unknowingly triggers it, injects arbitrary JavaScript that is stored on the site. The resulting stored XSS can allow the attacker to hijack the administrator’s session, deface content, or exfiltrate sensitive information. The weakness is a classic input‑validation flaw, classified as CWE‑79.

WordPress installations running tagDiv Composer versions 5.3 or earlier are affected; the flaw exists in the core Composer plugin that is commonly bundled with themes such as Newspaper. Any site that has not applied a newer Composer release is vulnerable.

The CVSS score of 6.1 indicates moderate severity. EPSS is below 1 %, suggesting rare exploitation, and the vulnerability is not listed in CISA KEV. Attackers need to trick an authenticated administrator into visiting a crafted URL to activate the CSRF request, implying a social‑engineering prerequisite rather than network‑level access. The risk remains moderate but could be elevated in high‑value sites where admins are frequently targeted.