CVE-2025-1705

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The tagDiv Composer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.3. This is due to missing or incorrect nonce validation within the td_ajax_get_views AJAX action. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Mar 28, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-17067.5Software installed and run as a non-privileged user may conduct improper GPU system calls to trigger use-after-free kernel exceptions.CVE-2025-17078.8The Review Schema plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.2.4 via post meta. This CVE-2025-17087.5The application is vulnerable to SQL injection attacks. An attacker is able to dump the PostgreSQL database and read its content.CVE-2025-17096.5Several credentials for the local PostgreSQL database are stored in plain text (partially base64 encoded).CVE-2025-17109.8The maxView Storage Manager does not implement sufficient measures to prevent multiple failed authentication attempts within a short time fr CVE-2025-17117.5Multiple services of the DUT as well as different scopes of the same service reuse the same credentials.CVE-2025-17128.8Argument injection in special agent configuration in Checkmk <2.4.0p1, <2.3.0p32, <2.2.0p42 and 2.1.0 allows authenticated attackers to writ CVE-2025-17137.5When setting up interrupt remapping for legacy PCI(-X) devices, including PCI(-X) bridges, a lookup of the upstream bridge is required. This CVE-2025-17146.9Lack of Rate Limiting in Sign-up workflow in Perforce Gliffy prior to version 4.14.0-7 on Gliffy online allows attacker to enumerate valid u CVE-2025-17169.8picklescan before 0.0.21 does not treat 'pip' as an unsafe global. An attacker could craft a malicious model that uses Pickle to pull in a m CVE-2025-17178.1The Login Me Now plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.7.2. This is due to insecur CVE-2025-17186.5An authenticated user with file access privilege via FTP access can cause the Relion 670/650 and SAM600-IO series device to reboot due to im