An input validation flaw in the tagDiv Composer WordPress plugin allows attackers to embed malicious scripts that are reflected back in the page. The vulnerability is a classic reflected XSS (CWE‑79) and enables client‑side code execution, which can lead to session hijacking, data theft, or malicious site manipulation if a user visits a crafted URL or submits a covert form.

All WordPress sites running the tagDiv Composer plugin up to and including version 5.4.2 are affected. Versions prior to the earliest release (i.e., any available installation of the plugin) are also vulnerable until the patch is applied. The issue does not apply to versions 5.4.3 and later.

The risk is moderated by the low likelihood of exploitation, with an indicated probability below 1%. Although the flaw is remotely exploitable via a crafted request, it requires the victim to visit or interact with a vulnerable page. It is not listed among the CISA Known Exploited Vulnerabilities catalog, indicating no known widespread exploitation.