Improper neutralization of input during web page generation in tagDiv Opt‑In Builder leads to reflected XSS. A crafted input can be reflected into a page and executed by a visitor’s browser, potentially allowing attackers to steal session cookies, deface the site, or perform phishing attacks. This weakness falls under CWE‑79, where user input is not safely encoded before output.

The vulnerability affects the WordPress tagDiv Opt‑In Builder plugin for all releases from its earliest version through 1.7.3. Site administrators using any of these versions are exposed.

The EPSS score of less than 1% suggests a low likelihood of exploitation, and the issue is not listed in the CISA KEV catalog. However, reflected XSS can be activated by a simple URL or form injection, so an attacker only needs to persuade a user to visit a malicious link. The severity depends on the environment; in a typical site it could enable client‑side attacks but does not allow direct server compromise.