The vulnerability arises from insufficient input sanitization and output escaping of the 'data' parameter in the tagDiv Composer plugin. Unauthenticated attackers can embed malicious scripts in the parameter, causing the scripts to run when a victim interacts with the crafted URL. The flaw permits arbitrary client‑side script execution, which can lead to session hijacking, phishing, or defacement. The weakness is identified as CWE‑79.

Customers using the WordPress tagDiv Composer plugin, primarily those running the Newspaper theme, are affected. All releases up to and including version 5.3 are vulnerable. The product is distributed as a WordPress plugin by tagDiv, and the vulnerability applies to any WordPress installation that has the plugin active in those versions.

The CVSS score is 6.1, indicating moderate severity. The EPSS score is below 1 %, suggesting a low probability of exploitation so far, and the vulnerability is not listed in the CISA KEV catalog. However, the attack vector is unauthenticated and only requires a user to click a malicious link, making it trivially exploitable from a technical standpoint. Due to the simplicity of the exploit, insiders or attackers relying on user traffic can feasibly spread it. Thus, while exploitation probability is low currently, the impact of successful exploitation is significant.