What is the CVSS score of CVE-2026-57733?

CVE-2026-57733 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.3%.

Which versions of tagDiv Cloud Library are affected by CVE-2026-57733?

The tagDiv Cloud Library WordPress plugin (versions up to 3.9.4) contains a stored cross-site scripting vulnerability allowing unauthenticated attackers to inject malicious scripts that can hijack…

How to fix or mitigate CVE-2026-57733?

Within 24 hours, conduct an inventory of all WordPress installations to identify whether tagDiv Cloud Library is deployed and immediately disable or remove the plugin if business requirements permit. Within 7 days, deploy web application firewall (WAF) rules configured to detect and block XSS payloads targeting the plugin's vulnerable parameters, enable enhanced logging for administrator account activity, and restrict administrative access via IP allowlist and multi-factor authentication enforcement. Within 30 days, complete an architectural review to identify replacement plugins or custom solutions providing equivalent functionality, and establish a formal migration timeline to eliminate dependency on tagDiv Cloud Library.

tagDiv Cloud Library CVE-2026-57733

EUVD-2026-43380 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-13 Patchstack

WordPress XSS Wordpress Plugin Tagdiv Cloud Library Tagdiv

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

7.1 HIGH

Unauthenticated network DOM-XSS needing victim interaction (UI:R); scope changes to the browser session (S:C) with limited C/I/A impact typical of XSS, matching the reported vector.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 10:41 vuln.today

CVE Published

Jul 13, 2026 - 08:41 cve.org

HIGH 7.1

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tagDiv tagDiv Cloud Library td-cloud-library allows DOM-Based XSS.This issue affects tagDiv Cloud Library: from n/a through <= 3.9.4.

AnalysisAI

Stored/DOM-based cross-site scripting in the tagDiv Cloud Library (td-cloud-library) WordPress plugin, versions up to and including 3.9.4, allows remote unauthenticated attackers to execute arbitrary JavaScript in a victim's browser when the victim interacts with a crafted input, per the CVSS PR:N/UI:R vector. Because the scope is changed (S:C), the injected script can affect resources beyond the vulnerable component - for example hijacking an authenticated administrator session. Reported by Patchstack; no public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Technical ContextAI

The tagDiv Cloud Library is a companion plugin used by tagDiv's commercial WordPress themes (notably Newspaper and Newsmag) to fetch and render remote demo/template assets. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), realized here as DOM-based XSS: client-side JavaScript writes attacker-influenceable data into the page DOM without proper sanitization or output encoding, so a payload is executed by the browser rather than reflected purely server-side. The single CPE, cpe:2.3:a:tagdiv:tagdiv_cloud_library:*:*:*:*:*:*:*:*, confirms the affected component is the plugin itself across all versions up to the fixed release.

RemediationAI

No vendor-released patch version is identified in the available data; the advisory indicates the flaw affects up to and including 3.9.4, so administrators should upgrade to the next release above 3.9.4 once tagDiv publishes it and monitor the Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/td-cloud-library/vulnerability/wordpress-tagdiv-cloud-library-plugin-3-9-4-cross-site-scripting-xss-vulnerability) and tagDiv's theme update channel for the fixed build. As compensating controls until a fix is applied, deploy a WordPress-aware WAF or virtual patch (Patchstack offers one for this CVE) to filter XSS payloads, restrict wp-admin and the plugin's template-loading endpoints to trusted IPs to reduce the chance an administrator triggers the payload, and ensure administrators avoid interacting with untrusted cloud-library content; note that WAF rules against DOM-based XSS are less reliable since the sink executes client-side, and IP restrictions may hinder legitimate remote editors.