This vulnerability is an unauthenticated Cross‑Site Scripting flaw present in all Tagembed plugin installations version 7.4 and earlier. The flaw allows an attacker to inject malicious scripts that are executed in the browsers of any user visiting a page that displays a Tagembed widget. Because the attack does not require authentication, any visitor can be targeted, leading to data theft, credential compromise, or defacement. The weakness is identified as CWE‑79.

The affected product is the WordPress Tagembed plugin, all releases up to and including 7.4. Those running an earlier, unpatched version are vulnerable. WordPress sites that have the Tagembed widget active are at risk.

The vulnerability carries a CVSS base score of 7.1, indicating high severity. No EPSS value is available, and the vulnerability is not listed in CISA's KEV catalog, so no confirmed exploitation reports are known. Because the flaw can be triggered by unauthenticated visitors using a specially crafted Tagembed entry, the attack surface is broad, but no privileges or network access are required beyond normal web traffic. The lack of known exploits reduces immediate risk, yet the high severity and wide attack surface warrant timely remediation.