The vulnerability is an improper neutralization of input that allows an attacker to inject arbitrary JavaScript into pages rendered by the tagDiv Composer plugin. The injected script runs in the context of the affected site, enabling cookie theft, session hijacking, defacement or malicious redirects for anyone who views the compromised page.

All WordPress sites using tagDiv Composer plugin version 5.4.1 or earlier are affected. Site administrators should verify the installed plugin version and ensure it is updated to a secure release.

The CVSS base score of 7.1 denotes high severity. The EPSS score is below 1 %, indicating that exploitation attempts are infrequent and the vulnerability has not been widely leveraged. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the weakness by inserting malicious input through the plugin’s content paths. Based on the description, it is inferred that privileged authentication is not required, which lowers the barrier to exploitation; however, the low EPSS suggests that sophisticated attackers may currently be targeting higher‑value platforms.