The tagDiv Composer plugin for WordPress contains a reflected cross‑site scripting flaw that permits unauthenticated attackers to inject user‑controlled scripts via the 'account_id' and 'account_username' parameters. These parameters are exposed in the URL and the plugin fails to apply proper input sanitization or output escaping. The flaw allows an attacker to embed arbitrary scripts that will run in the victim's browser when the user clicks a crafted link or visits a malicious URL, leading to theft of credentials, session hijacking or malicious content injection. The weakness is a classic input validation flaw (CWE‑79).

This vulnerability affects all releases of the tagDiv Composer plugin up to and including version 5.3. The plugin is commonly bundled with the Newspaper theme on WordPress sites. Users running any of these versions are exposed to the flaw unless they update to a patched release beyond 5.3.

The CVSS score of 6.1 indicates a moderate severity. The EPSS score of less than 1 percent shows a low probability of exploitation in the wild, and the flaw is not listed in the CISA KEV catalogue. Attackers can trigger the exploit by delivering a crafted URL containing malicious payloads in the 'account_id' or 'account_username' parameters and luring a user to click it. Successful exploitation would only affect the victim’s browser session and does not allow direct code execution on the server.