The tagDiv Composer WordPress plugin allows users to embed raw HTML via the vc_raw_html shortcode. The plugin’s rendering function decodes Base64 content without properly sanitizing or escaping it, so an attacker can place a Base64‑encoded string containing malicious JavaScript that bypasses WordPress’s save‑time filtering. When the content is rendered, the script is injected directly into the page’s HTML and will execute in any browser that loads the affected page, allowing the attacker to compromise the victim’s session, deface the site or execute further attacks.

tagDiv Composer plugin v5.4.5 and all earlier releases are vulnerable. The vulnerability affects any WordPress installation that has the plugin installed and permits creation or modification of pages using the vc_raw_html shortcode.

The vulnerability is scored at CVSS 6.4, indicating moderate severity. No EPSS score is published, and the not currently listed in CISA’s KEV catalog. The attack requires an authenticated user with Contributor or higher privileges, which the description confirms. An attacker must first obtain such credentials or exploit an already compromised Contributor account; once achieved, the attacker can create or edit content that contains the malformed shortcode, causing arbitrary JavaScript to run in the browsers of anyone who views or previews the affected page.