Improper neutralization of input during web page generation in tagDiv Opt‑In Builder leads to reflected XSS. A crafted input can be reflected into a page and executed by a visitor’s browser, potentially allowing attackers to steal session cookies, deface the site, or perform phishing attacks. This weakness falls under CWE‑79, where user input is not safely encoded before output.

The vulnerability affects the WordPress tagDiv Opt‑In Builder plugin for all releases from its earliest version through 1.7.3. Site administrators using any of these versions are exposed.

The CVSS score of 7.1 classifies the vulnerability as high severity. The EPSS score of less than 1% indicates a low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. However, reflected XSS can be triggered by a simple URL or form injection, so an attacker only needs to persuade a user to visit a malicious link. The impact is limited to client‑side code execution, which could enable session hijacking, defacement, or phishing. No direct server compromise is possible.