The tagDiv Composer plugin for WordPress contains a stored cross‑site scripting flaw caused by inadequate sanitization and output escaping of user‑supplied shortcode attributes. An attacker with contributor‑level or higher access can insert malicious scripts that are permanently stored and executed whenever a page containing the affected shortcode is viewed by any user. The impact includes defacement, theft of session cookies, and arbitrary script execution on the victim’s browser.

WordPress sites that use the tagDiv Composer plugin up to and including version 5.4 are susceptible. The weakness applies to all user roles that can create or edit content, specifically contributors and higher. The affected plugin is named tagDiv Composer, provided by the vendor tagDiv.

The CVSS score is 6.4, indicating moderate severity. The EPSS score is below 1%, suggesting low likelihood of widespread exploitation at this time, and the vulnerability is not listed in CISA’s KEV catalog. The attack requires authenticated access with contributor privileges, so it is limited to users who have been granted such permissions. Once the injected code is embedded, any visitor to the compromised page will be exposed to the attacker’s script, which can facilitate additional attacks such as session hijacking or credential disclosure.