This flaw is a DOM‑based XSS that occurs when the plugin does not encode data supplied by a user before rendering it on a page. An attacker can inject malicious scripts that then run in the victim’s browser when the page is viewed. The impact is limited to client‑side script execution, but it can be used to manipulate the page, steal credentials, or redirect users. No evidence of confidentiality or integrity compromise beyond script execution is documented.

The WordPress plugin tagDiv Opt‑In Builder, versions 1.7.4 and earlier, is affected. No other products or platforms are listed by the CNA.

The CVSS score of 7.1 indicates high severity for a DOM‑based XSS. The EPSS score of less than 1% points to a very low probability of exploitation in the current environment. The vulnerability is not in the KEV catalog. The flaw can be exercised by placing malicious content into the plugin’s input fields, which the plugin then reflects on a page. The attacker’s access is client‑side; an unwary user must visit a page that incorporates the manipulated data for the attack to succeed.