CVE-2025-3510 – TagDiv Composer WordPress Stored Cross-Site Scripting Vulnerability

May 2, 2025

CVE ID : CVE-2025-3510

Published : May 2, 2025, 4:15 a.m. | 3 hours, 5 minutes ago

Description : The tagDiv Composer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple shortcodes in all versions up to, and including, 5.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Severity: 6.4 | MEDIUM

Visit the link for more details, such as CVSS details, affected products, timeline, and more…

Source: Read More

Previous ArticleCVE-2025-3709 – Agentflow from Flowring Technology Account Lockout Bypass Vulnerability

Next Article CVE-2025-1326 – Homey WordPress Missing Capability Check Data Deletion Vulnerability

Highlights

CVE-2025-20286 – “Cisco ISE Cloud Credential Exposure Vulnerability”

June 4, 2025

CVE ID : CVE-2025-20286

Published : June 4, 2025, 5:15 p.m. | 2 hours, 21 minutes ago

Description : A vulnerability in Amazon Web Services (AWS), Microsoft Azure, and Oracle Cloud Infrastructure (OCI) cloud deployments of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to access sensitive data, execute limited administrative operations, modify system configurations, or disrupt services within the impacted systems.

This vulnerability exists because credentials are improperly generated when Cisco ISE is being deployed on cloud platforms, resulting in different Cisco ISE deployments sharing the same credentials. These credentials are shared across multiple Cisco ISE deployments as long as the software release and cloud platform are the same. An attacker could exploit this vulnerability by extracting the user credentials from Cisco ISE that is deployed in the cloud and then using them to access Cisco ISE that is deployed in other cloud environments through unsecured ports. A successful exploit could allow the attacker to access sensitive data, execute limited administrative operations, modify system configurations, or disrupt services within the impacted systems.
Note: If the Primary Administration node is deployed in the cloud, then Cisco ISE is affected by this vulnerability. If the Primary Administration node is on-premises, then it is not affected.

Severity: 9.9 | CRITICAL

Visit the link for more details, such as CVSS details, affected products, timeline, and more…

UX Job Interview Helpers

.NET Aspire’s CLI reaches general availability in 9.4 release

15 Essential Skills to Look for When Hiring Node.js Developers for Enterprise Projects (2025-2026)

African training program creates developers with cloud-native skills

Why I’ll keep the Samsung Z Fold 7 over the Pixel 10 Pro Fold – especially if these rumors are true

You may soon get Starlink internet for a much lower ‘Community’ price – here’s how

uBlock Origin Lite has finally arrived for Safari – with one important caveat

Perplexity says Cloudflare’s accusations of ‘stealth’ AI scraping are based on embarrassing errors

Send Notifications in Laravel with Firebase Cloud Messaging and Notifire

Send Notifications in Laravel with Firebase Cloud Messaging and Notifire

Simplified Batch Job Creation with Laravel’s Enhanced Artisan Command

Send Notifications in Laravel with Firebase Cloud Messaging and Notifire

This comfy mesh office chair I’ve been testing costs less than $400 — but there’s a worthy alternative that’s far more affordable

This comfy mesh office chair I’ve been testing costs less than $400 — but there’s a worthy alternative that’s far more affordable

How to get started with Markdown in the Notepad app for Windows 11

Microsoft Account Lockout: LibreOffice Developer’s Week-Long Nightmare Raises Concerns

CVE-2025-3510 – TagDiv Composer WordPress Stored Cross-Site Scripting Vulnerability

SonicWall Investigating Potential SSL VPN Zero-Day After 20+ Targeted Attacks Reported

Think Before You Download: UAE Cybersecurity Council Issues Warning on Unverified Apps

How to try Veo 3, Google’s AI video generator that’s going viral on the internet

Is your TV sluggish? How to update its firmware via USB stick to speed it up

13 Arrested in Romania Over Phishing-Based UK Tax Fraud Scheme

CVE-2025-34090 – “Google Chrome AppBound Cookie Encryption Bypass”

CVE-2025-20286 – “Cisco ISE Cloud Credential Exposure Vulnerability”

Crafting SEO Content That Readers Love

CVE-2025-30744 – Oracle Mobile Field Service HTTP Unauthorized Access and Data Manipulation Vulnerability

Forminator plugin flaw exposes WordPress sites to takeover attacks

CVE-2025-3510 – TagDiv Composer WordPress Stored Cross-Site Scripting Vulnerability

Related Posts