The vulnerability is improper neutralization of input during web page generation, allowing a DOM‑based XSS attack. The flaw can be exploited to inject malicious JavaScript that runs in the victim’s browser, leading to data theft, credential compromise or defacement. It is a classic input sanitization failure, identified as CWE‑79."

Any WordPress installation that uses the tagDiv Composer plugin version 5.4.2 or earlier is affected. The plugin is a common theme‑builder component, so a wide range of sites that have not upgraded past 5.4.2 are at risk."

The CVSS score of 6.5 indicates moderate severity. The EPSS rating of less than 1% suggests a low likelihood of exploitation at this time, and the vulnerability is not listed in CISA’s KEV catalog. The attack can be carried out from a malicious link or user input, requires no special privileges, and would affect the victim’s browser session only."