This vulnerability arises from improper input sanitization in the tagDiv Composer plugin, allowing attackers to store malicious scripts that run in the browser of anyone who views the affected content. The stored JavaScript can be used to steal session cookies, deface sites, or redirect users to malicious sites, thereby compromising confidentiality and integrity of data seen by site visitors.

WordPress sites running the tagDiv Composer plugin version 5.4.3 or earlier are affected. This includes all releases from the earliest version up through 5.4.3, regardless of minor patch levels. Site owners using the plugin should check their WordPress installation for the presence of tagDiv Composer and verify the current version.

The CVSS base score of 6.5 indicates a moderate risk, and the EPSS score of less than 1 % suggests a low probability of widespread exploitation. The vulnerability is not listed in CISA’s KEV catalog, further indicating limited evidence of active attacks. Attackers can exploit the flaw by creating or editing content within the Composer interface, injecting JavaScript that is then rendered to all page visitors. Because the payload is stored, the attack is persistent and can affect authenticated and unauthenticated users alike.