tagDiv Composer 5.4.4. unauthenticated user enumeration & AJAX vulnerability
Our site (running tagDiv Composer 5.4.4) was hit (STILL IS) with over 160,000 requests in less than 24 hours.
The attacker used the admin-ajax.php endpoint with Newspaper theme actions to trigger password reset triggers for the username teryaljw.teryaljw.
The bot is sending POST requests to: admin-ajax.php?td_theme_name=Newspaper&v=12.7.5
Even with “Anyone can register” set to OFF, the theme’s AJAX handler for user functions allows unauthenticated triggers of the WordPress wp_mail function via lostpassword_post. This allows the site to be used as a “spam relay” and causes massive server load.
In comparison, standard WordPress core blocks these attempts at the login screen while the Newspaper AJAX handler is bypassing these core protections.
Please implement Nonce Validation and Unauthenticated Request Filtering for all td_ajax_ account functions.
Hi,
The taxonomy=tdtax_app_tag and ?taxonomy=tdtax_app_category taxonomies were added through the ACF plugin and can be modified there: https://prnt.sc/haKu1OuDxYn0
After making changes, make sure to set the Cloud Template for the new taxonomy. Keep in mind that if you change the slug, the previously added entries will no longer appear, because the new slug creates a different taxonomy parameter.
Also, don’t forget to update the slug in Composer for elements such as filters and Flex Blocks, so that the correct taxonomy is displayed.
Hello tagDiv Support,
I need help with a serious issue that started after updating Newspaper. I have spent hours troubleshooting this and I want to give you a clear, detailed summary so you can understand exactly what is happening.
My site:
MarryCaribbean.com
Theme:
Newspaper
Problem summary:
After the update, my single post pages began crashing and showing the WordPress critical error message. At the same time, several layout behaviors changed unexpectedly, including my post hero styling and category/archive display.
Here is what I observed and tested.
1. Single posts started failing after the Newspaper update
Before the update, my single posts were working normally.
After the update:
* Single post pages began showing “There has been a critical error on this website.”
* This was happening under Newspaper, while the site worked under a default WordPress theme.
* Category pages and other parts of the site were not failing in the same way at first, which made this look specific to the Newspaper single post rendering path.
2. Debugging pointed to td-composer
I enabled WordPress debug logging and found fatal errors pointing to td-composer, specifically memory exhaustion in this path:
/wp-content/plugins/td-composer/legacy/common/wp_booster/td_util.php
I also saw repeated notices for translation loading from other plugins, but those did not appear to be the main cause of the front-end post failure.
The key fatal I saw was memory exhaustion inside td-composer.
3. Default WordPress theme worked
To isolate the issue, I temporarily switched to a default WordPress theme.
Result:
* The single posts loaded
* The content itself was fine
* This suggested the problem was not with WordPress core or the post content itself, but with Newspaper/tagDiv rendering
4. Backup restore did not solve the issue
I restored a backup using UpdraftPlus, including:
Database
Plugins
Themes
However, this did not restore the previous Newspaper behavior on its own. The single post issue remained. What actually made individual posts load again was manually opening them and explicitly selecting a post template such as FROM PANEL or DEFAULT and then updating the post.
5. tagDiv Composer / Cloud Library behavior was inconsistent
After the restore:
* tagDiv Composer and tagDiv Cloud Library had to be reactivated
* Header/footer/custom appearance behavior changed depending on whether these plugins were active
* At one stage, single posts worked with Composer off, but the custom header/footer/design was degraded
* With Composer on, other design pieces came back, but single post behavior was still unstable or altered
6. The biggest discovery: post template behavior changed
This appears to be the most important clue.
I found that many posts would work again only after I manually opened the post and explicitly selected a post template, for example:
* FROM PANEL
or
* DEFAULT
If I manually selected one of those and updated the post, the post would usually load again.
This strongly suggests the update changed or broke how post template settings were being inherited or interpreted.
What is especially concerning is that this appears to affect many posts, not just one or two.
7. “From Panel” is not consistently broken, but behavior changed
I originally thought FROM PANEL itself was broken, but after more testing I found:
* Some posts work on FROM PANEL
* Some posts work on DEFAULT
* Some posts needed to be manually touched and saved before they would work at all
So the issue does not seem to be as simple as “FROM PANEL is broken.”
It feels more like the update disrupted how template/layout assignments are being inherited or loaded on a per-post basis.
8. My hero/header layout on single posts changed
Even after I got the posts loading again, the visual layout is not what it was before.
Before:
* My post hero had a stronger designed look
* The title, author, tags, and hero image styling appeared more integrated/overlaid
* There was more of a styled hero presentation
Now:
* The posts may load, but the hero/header presentation is simplified or degraded
* The featured image sits more plainly
* The old styled hero treatment appears to be missing
So even when the post works, the layout is not the same as before the update.
9. Article Display View options appear to be missing
In the Theme Panel, under areas where I remember having many layout/style choices, the “Article Display View” area appears blank or missing its usual options.
I specifically remember having many appearance/layout choices there before. Now those options do not appear to load properly.
This makes me think some template/module UI in Newspaper is no longer loading correctly after the update.
10. Category/archive behavior also changed
After the update:
* My category/archive sections changed layout
* I had 3 items per row before, but now it is showing 2
* I also started seeing little comment count boxes with “0”, which I never wanted and did not have before
I checked Block Settings and global module meta settings. Show Comment Count appears to be off globally, but the archive/category output is still not matching what I had before.
This makes it seem like the archive/module style or template behavior changed during the update as well.
11. Cloud Templates screen appears empty
In Cloud Templates, I currently do not see cloud templates assigned in the way I expected. For example, the Single Templates area appears empty.
That is confusing because I know my site had a more customized appearance before, and the current theme behavior no longer matches it.
12. Main concern
My biggest concern is that this update appears to have:
* broken or altered post template inheritance
* changed single post rendering behavior
* removed or failed to load layout options I previously had
* changed archive/category display unexpectedly
On a larger site, this kind of behavior is extremely disruptive because it can force manual repair of many posts.
What I need from you:
1. Help identifying exactly what changed in Newspaper that caused single post template behavior to break or stop inheriting correctly
2. Help restoring the original post hero/layout behavior I had before the update
3. Help restoring the archive/category display so it matches the previous layout
4. Help understanding why the Article Display View choices appear missing/blank
5. Guidance on whether this is a known issue in the current version and whether there is a patch or recommended fix
I would appreciate a serious look at this, because this has taken a lot of time to troubleshoot and it clearly appears connected to the Newspaper/tagDiv update path rather than WordPress itself.
Thank you,
MarryCaribbean.com
Hello,
i have created two custom blocks. I want to use them inside a “Module cloud template” to render items in a “Flex Loop Builder”
I used de td-api-plugin. I can drag and Drop de block inside de tag div editor but something is not working. I can save de “module template” the first time but when i edit again it returns an ERROR “Errors at columns elements: 1(models) : 0(dom). The model does not match the content Current state has involved an issue. You could try an UNDO operation (CTRL+Z / CTRL+SHIFT+Z)”
What i am doing wrong?
This is how i add the api block (it has no parameters, all is coded into de file that renders the module -> td_video_empresa.php):
td_api_block::add('td_video_empresa',
array(
'map_in_visual_composer' => false,
'map_in_td_composer' => true,
"name" => 'Mòdul Video Empresa',
"base" => "td_video_empresa",
'tdc_category' => 'Modules elements',
'file' => $this->plugin_path . '/modules/td_video_empresa.php',
"params" =>
array_merge(
td_config::get_map_block_general_array()
)
)
);
This is the file that renders the block -> td_video_empresa.php
class td_video_empresa extends tdb_module_template_part {
function render( $atts, $content = null ) {
/* -- Call the parent render method -- */
parent::render($atts);
/* -- Retrieve the module post data -- */
$post_obj = self::$post_obj;
$post_type = null;
$postID=$post_obj->ID;
$url_video=get_field("url_video_empresa",$postID);
$video_extern=get_field("link_finestra_nova",$postID);
$logo=get_post_thumbnail_id($postID);
$linkEmpresa=get_permalink($postID);
$tituloEmpresa=$post_obj->post_title;
$string="";
$string.=renderVideo($url_video,220,$tituloEmpresa,$postID);
$string.='<div class="modul-caixa" >';
$string.='<h3 style="margin:0px;">'.$post_obj->post_title.'</h3>';
$string.='</div>';
return $string;
}
}
Hi,
If you are referring to clearing the post view counts that are already saved in teh theme panelm then I’m afraid there is no option for this, it needs to be done manually in the database using s mysql script or usinga function in functions.php to overright all view fields and set them to 0;
I manage to make a function that can help you, you can get it from here -> https://pastebin.com/VX9Nd7zT , you need to set it in wp-content/plugins/td-composer/legacy/Newspaper/functions.php like this -> https://i.imgur.com/ZNMViNG.png after that refresh your posts and check if the view counter are set on each posts after that remove the code from function ( if not the view counter will be overwrite with 0, you can set the number you want).
Before doing anything, make sure that you have a full backup for your website and database.
Thank you!
Hi,
When you see shortcodes on your website, and those contain td, this means that one of the theme plugins that should be active is not installed and activated. The theme plugins can be installed from Newspaper > Plugins, and you usually need tagDiv Composer, for cloud template tagDiv Cloud Library, and for old templates, you need tagDiv Standard Pack plugin.
I am upgrading my theme from v9 to v12
My regular website is fomo-vox.com ( running with theme newspaper 9)
I am testing the theme newspaper 12 on a temporary url https://fomo-test.ovh/ that I will close when everything will be ok
My regular site fomo-vox ( on newspaper 9) uses td composer for the front page fomo-vox.com
When I update from newspaper 9 to newspaper 12 I lost the layout of the articles on home page
What should I do?
Calin, good evening. This 404 error is only increasing in Google Search. One solution is to effectively edit wp-content/plugins/td-composer/mobile/header-amp.php to include nofollow parameters? A curious situation is that this error has never happened to us over several years – and with the increase reported by Google, we are concerned about our site’s ranking being lowered in the search engine. Is this a theme update issue?
I can edit the file directly from WordPress; could you guide me on how to do it?
Thank you.
Hi,
Our theme now provides the frontent builder tagDiv Composer that can be use or creating pages and cloud template start can be used on articles, categories, taxonomies, CPT’s …. and you can import from teh cloud a pre-built template and just edit it, add any elements you want to be display and remove those you do not want or you can create it from scratch.
If you created a php file template thsi should be set in a child theme and the theme panel option referring to “Display Featured Image (Show/Hide)” use the get_image https://prnt.sc/LGwD_L8aCgc9. This is defined in wp-content/plugins/td-composer/legacy/common/wp_booster/td_module_single_base.php https://prnt.sc/7zMeWS6BJ19E
Thank you!
Hi,
I see that the images are displaying the attachment path instead of displaying them in a pop-up modal.
Here is a quick fix that can be used. On the cloud category template use tagDiv Composer and in a raw HTML element, add this js code:
jQuery(document).ready(function($) {
$('.tdm-inline-image-wrap img').each(function() {
var $parentLink = $(this).parent('a');
if ($parentLink.length) {
$parentLink.addClass('td-modal-image');
}
});
$('.td-modal-image').magnificPopup({
type: 'image',
gallery: {
enabled: true
}
});
});
This should be set between script tags like this – https://prnt.sc/JEUuywa7ias6
I hope this will help you!
Hi,
I think that you are referring to a similar small editor -> https://i.imgur.com/WK2rE82.png – https://prnt.sc/Gv6UZlWayxdX
In the most of the cases this problem can be fixed by adding an extra code, please set this code in functions.php -> wp-content/plugins/td-composer/legacy/Newspaper/functions.php or in functions.php in a child theme.
If the problem persists, please send us an email at contact@tagdiv.com and provide admin login. Include a link to this topic in the email. Let us know.
Let me know the results!
Thank you!
Hello, we have recently integrated Google Programmable Search Engine (GPSE) as our site search, replacing the native WordPress search. To make this work with the theme’s search elements, we implemented a small JavaScript function ( fixSearchForms() ) which you can see in the page source (greekreporter.com). The script handles:
- Redirecting all search form submissions ( classes tdb-search-form and td-search-form ) to our GPSE results page.
- Rewriting the ” View all results “ link in the mobile live search dropdown to point to the GPSE results page with the correct query parameter (?q= instead of ?s=).
This covers both the desktop Header Live Search element and the Mobile Live search element. We have two questions:
- Is this the recommended approach for integrating an external search engine with the theme’s search elements, or is there a more native/supported method we may have missed – either through tagDiv Composer settings or theme options – that would handle the form redirects and button links without requiring a custom script?
- Is there an official hook, filter or supported method to replace the live search AJAX results (currently using WordPress native search) with results from an external search API like GPSE, while keeping the existing live search UI and dropdown intact?
If option (2) is not currently supported, are there any theme-native alternatives you would recommend for live search functionality?
Additionally, is there a way to limit or restrict the native live search results to improve response speed? When a query returns many results the delay is significant, and since only the first 3-4 results are displayed in the dropdown, could we somehow cap the number of results the query returns to reduce that latency? We consider this a viable alternative if replacing the live search with GPSE results is not easily achievable, especially since the ” View all results “ link already redirects to the GPSE results page as mentioned above. Thank you!
Best regards,
Hi,
Using the mobile theme and amo will display for users a simplify verion. When are used together as in your screenshot, the same simplified layout will be displayed on both mobile and amp. If you want to have the responsive version on mobile, then use the mobile theme only for the AMP (select the last option from your screenshot), then the simplified version of the mobile theme will be used for AMP and the responsive version for mobile.
Now to stop the parameters from appearing anywhere, there are 2 options: stop using amp or edit the file wp-content/plugins/td-composer/mobile/header-amp.php (most users have given up on amps these days, as they are no longer needed as they were in the past)
Thank you!
Good evening.
I’m analyzing our website on PageSpeed Insights and two references with high transfer rates appeared – links below. Could you clarify what they are? One of the links refers to – Magnific Popup – v0.9.9 – 2013-12-27. Are these theme structures – can they be deleted or optimized? Thank you very much.
https://www.cidademarketing.com.br/marketing/wp-content/plugins/td-composer/legacy/Newsmag/js/tagdiv_theme.min.js?ver=5.4.3.5
https://www.cidademarketing.com.br/marketing/wp-content/plugins/td-composer/legacy/Newsmag/assets/css/td_legacy_main.css?ver=dabc3295375a4d2df3fc2a20843da2d5
Thanks
Hi,
but do I have to add the path to deferred mode? I’ve been using Wp-Rocket for years and have deferred mode enabled. Below, I can exclude the JS from this mode. And then: do I have to add the path? For example: /wp-content/plugins/td-composer/legacy/Newspaper/js/tdMenu.js?
Thanks
Alex
Bonjour l’équipe tagDiv,
J’utilise le thème Newspaper avec tagDiv Composer et j’ai un problème d’optimisation LCP (Core Web Vitals) sur mes blocs.
Actuellement, mon Flex Block 1 génère les images sous forme de background-image à l’intérieur d’une balise <span>. Cela m’empêche d’utiliser l’attribut fetchpriority=”high” pour optimiser le chargement des images principales.
Ma question est la suivante :
Est-il possible de configurer le Flex Block 1 directement dans l’éditeur pour qu’il génère une balise réelle (comme c’est le cas à l’intérieur de mes articles) ? Ou dois-je obligatoirement ajouter un code PHP personnalisé pour forcer ce comportement ?
Voici le code actuel généré par mon bloc :
HTML
<span class=”entry-thumb td-thumb-css” style=”background-image: url(‘image.jpg’);”
lien de sit web : JOBMA.MA
merci :
Hi,
You can set with tagDiv Composer on that block a class and you can trigger that class and the category – https://prnt.sc/tPO1gVL-GXqC – https://prnt.sc/1eJgpNbRv21A after you add the class, let’s say this is ‘my-class’ use thsi css:
.my-class .td-post-category {
display: none;
}
Thank you!
Hi,
The file is on the path wp-content/plugins/td-composer/legacy/Newspaper/includes/modules/td_module_single.php, but please notice that any changes made in the file will be lost when the plugin is updated.
What exactly do you want to edit in it? Maybe there is a different way.
Hi thalesbrandao,
The parameters:
{{post_cat_link}}
{{post_url}}
{{td_query_all_results}}
Exists only in one file wp-content/plugins/td-composer/mobile/header-amp.php and thsi is used only when you are using the amp plugin with the mobile theme plugins and one of the options – https://prnt.sc/Ii6EfD58TpTu but those parameters have the rel tag for nofollow therfore should not be indexed in GSC https://prnt.sc/6wyyY9Yrwk4p
Thank you for your understaing!
Hello TagDiv Support,
I am using the Newspaper Theme (latest version) with TD Composer.
I am experiencing a template-level issue in the Single Post Template – Free News.
Issue Description:
A block titled “আরও দেখুন” (More Stories / Category tag list) is automatically appearing at the top of all single post pages.
This block:
• Appears in two different layouts across different posts
• Is not selectable inside TD Composer
• Clicking on it opens a sliding overlay panel instead of selecting a Row/Element
• Does not appear properly inside the Manager structure
• Cannot be removed from the template
What I Already Tried:
Disabled Articles Auto Loading
Checked Single Template Settings
Checked Category Template
Disabled Related Articles
Disabled More Articles Box
Cleared Cache (LiteSpeed)
Edited the template from Cloud Templates
Tried deleting the Row via Backend & Frontend editor
Still, the block persists.
Observation:
It seems like the block is injected dynamically (possibly via auto-loading, category module, or internal tdb_single_content hook).
When clicking the block, only the gear (⚙️) icon works, and the rest of the area is not selectable — which suggests a layer or JS overlay conflict.
Request:
Please clarify:
From which template hook or module is this block generated?
Is it part of tdb_single_content?
Is it controlled by a hidden “Tags” module?
How can I permanently remove it from the Single Post template?
This is affecting layout consistency and UX.
Website: https://newsbazar24.com
Theme: Newspaper
Template: Single Post Template – Free News
Screenshots attached for reference.
Thank you.
Best regards,
Sankar Chakraborty
Hi,
That security vulnerability was fixed, just make sure that you are using the latest theme version, Newsapper v12.7.4, with tagDiv Composer version 5.4.3 – https://patchstack.com/database/Wordpress/Plugin/td-composer/vulnerability/wordpress-tagdiv-composer-plugin-5-4-2-cross-site-scripting-xss-vulnerability?_s_id=cve
https://forum.tagdiv.com/how-to-update-the-theme-2/
Thank you!
On 6 February 2026 the header section of our Newspaper based website suddenly showed no content but code looking like tagDiv code:
[tdb_header_logo align_vert="content-vert-center" align_horiz="content-horiz-center" image_width="eyJwb3J0cmFpdCI6IjIyMCIsImFsbCI6IjMxMCJ9"
.....
[tdb_header_menu main_sub_tdicon="td-icon-down" sub_tdicon="td-icon-right-arrow" mm_align_horiz="content-horiz-center" modules_on_row_regular="20%"
You can view that on https://www.pfarregersthof.at/komm/
Recent changes to the WordPress of the site:
- tagDiv Newspaper was updated to version 12.7.4 on about 2 February
- WP was updated from version 6.9 to 6.9.1 on 4 February
- The WP plugin Advanced Post Types Order was updated to version 5.9.3 on 6 February
I tried to fix this header issue with these actions:
- Deactivated plugin Advanced Post Types Order: no success
- With Newspaper Time Machine returned to version 12.7.3: no success
- Had a look at the homepage with tagDiv editor: the HEADER MENU shows a mix of this [tdb …] code and EMPTY COLUMN and EMPTY INNER COLUMN placeholders. The CONTENT parts look ok.
- Installed the WP database backup of 1 February: no success
- Uninstalled the tagDiv Composer plugin (the only active tagDiv plugin on our website) …
- … and installed and activated tagDiv Composer via Newspaper theme/Plugins: no success. I noticed while the tagDiv composer was not active the site showed the header: a logo and the main menue of the site.
At this point I gave up.
Hi tagDiv Team,
I am using Newspaper theme v12.7.4 on my live site:
Hosting: Hostinger Shared Hosting
WordPress Version: 6.9
PHP Version tested:
– PHP 8.2.27 (default)
– PHP 8.1.31 (downgraded)
Problem:
As soon as I activate the plugin “tagDiv Composer” (td-composer), WordPress admin AJAX breaks.
When I open:
https://odishajobsdesk.in/wp-admin/admin-ajax.php
Instead of returning “0”, it shows wp_booster errors like:
– The tdc_state::$is_live_editor_ajax is NOT set
– wp_booster error: component with ID tds_util is not set
– Missing parameter: file
File paths:
wp-content/plugins/td-composer/legacy/common/wp_booster/td_api.php
wp-content/plugins/td-composer/legacy/common/wp_booster/td_autoload_classes.php
Effects:
– Newspaper panel shows “Ajax error” for Composer and Cloud Library
– Plugin installer fails
– WordPress login shows:
“Cookies are blocked due to unexpected output”
– Dashboard becomes unstable until td-composer is disabled
If I rename td-composer folder, admin-ajax.php returns normal “0” again.
Request:
Please provide the latest PHP 8.1/8.2 compatible td-composer build or advise the correct plugin/theme version combination for Newspaper 12.7.4.
Thank you.
Hi,
I see, if you want to use it on the trending now element from tagDiv Composer, you can use this custom css
.td_block_trending_now:before {
content: "";
position: absolute;
background-image: url(data:image/svg+xml;base64,PHN2ZyB3aWR0aD0iMTgiIGhlaWdodD0iMTAiIGZpbGw9Im5vbmUiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyI+PHBhdGggZD0iTTEuODMzIDEwTC42NjcgOC44MzNsNi4xNjYtNi4yMDggMy4zMzQgMy4zMzNMMTQuNSAxLjY2N2gtMi4xNjdWMGg1djVoLTEuNjY2VjIuODMzbC01LjUgNS41TDYuODMzIDVsLTUgNXoiIGZpbGw9IiMwMDAiLz48L3N2Zz4=);
background-position: 0;
background-repeat: no-repeat;
width: 100%;
height: 100%;
top: 1px;
left: -4px;
}
The results will be – https://prnt.sc/vFakDGQG2bCR
Thank you!
