Wordpress Plugin CVE-2026-57732

The tagDiv Opt-In Builder WordPress plugin (td-subscription) contains a cross-site scripting vulnerability affecting versions through 1.7.4 that allows remote attackers to inject malicious code viewed by website visitors. Organizations using this plugin face immediate risk of customer data theft, website manipulation, and regulatory exposure, with no public exploit identified at the time of analysis. No vendor patch is currently available, making rapid vulnerability scanning and mitigation essential.

Within 24 hours, audit all WordPress installations to identify deployments of td-subscription plugin versions 1.7.4 or earlier, and disable or remove the plugin immediately as an emergency measure. Over the next 7 days, monitor the tagDiv vendor advisory and plugin repository for patch announcements; simultaneously implement interim technical controls including Web Application Firewall (WAF) rules targeting XSS payload patterns and Content Security Policy (CSP) headers to restrict inline script execution. Within 30 days of patch availability, apply the vendor-released patch after staging testing, or migrate to an alternative subscription/opt-in solution; conduct log analysis to identify any exploitation attempts that occurred during the unpatched window.

No vendor-released patch identified at time of analysis. Interim mitigations: (1) Disable or remove the plugin until patch is released; (2) Implement Content Security Policy headers restricting script-src to trusted sources only; (3) Deploy Web Application Firewall rules to block common XSS injection patterns; (4) Enable enhanced logging and monitoring for suspicious script injection attempts; (5) If the plugin cannot be disabled, restrict administrative access and consider network segmentation for critical systems.