A flaw in the tagDiv Composer plugin allows malicious scripts to be injected through improperly sanitized shortcodes. This basic cross‑site scripting weakness can be exploited to run arbitrary JavaScript when a page containing the affected shortcode is viewed. The vulnerability stems from a failure to neutralize script‑related HTML tags, making it a CWE‑80 type issue. Successful exploitation could enable defacement, data theft, or user session hijacking depending on the attacker’s objectives.

WordPress sites that incorporate the tagDiv Composer plugin, specifically all releases from the earliest available version through 5.4.3. The issue applies to any installation of the plugin that does not enforce its default sanitization rules, which is common in stock configurations. Administrators should verify the plugin version and whether the shortcode feature is enabled.

The CVSS score of 5.3 reflects a moderate severity, while the exploit potential is considered low, as the referential probability is under 1 percent and it has not yet appeared in the Key Exploited Vulnerabilities catalog. The likely attack vector is remote web‑based input: an adversary can supply a crafted shortcode containing malicious script tags, which the plugin then renders unfiltered. In a successful scenario, the attacker would gain the ability to execute code within the context of the compromised site, potentially leading to defacement, data exfiltration, or further system compromise.