The tagDiv Composer plugin for WordPress contains a Cross-Site Request Forgery vulnerability due to missing or incorrect nonce validation in the td_ajax_get_views AJAX action. This flaw enables unauthenticated attackers to inject malicious scripts by tricking site administrators into performing actions such as clicking on malicious links. The vulnerability affects all versions up to and including 5.3 and is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation, i.e., Cross-site Scripting). The CVSS 3.1 base score is 6.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity.

Successful exploitation can lead to reflected cross-site scripting attacks, allowing attackers to execute arbitrary scripts in the context of the site administrator's browser session. This can compromise confidentiality and integrity of data accessible to the administrator. There is no impact on availability. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should limit exposure by restricting access to administrative interfaces, avoid clicking on untrusted links, and consider disabling or restricting the vulnerable AJAX action if possible. Monitor tagDiv vendor communications for updates and apply patches promptly once available.