tagDiv Composer CVE-2026-57734

Exploitation requires the attacker to lure an authenticated or otherwise targeted user into clicking a crafted link or visiting an attacker-controlled page (UI:R) that supplies a malicious value to the vulnerable tagDiv Composer request parameter; the payload is reflected, so it is not stored and must be delivered per-victim. No attacker authentication is required (PR:N) and the site is reachable over the network (AV:N), but the reliance on user interaction and the need to target a user whose session is worth hijacking are the key limiting factors. The site must be running tagDiv Composer at version 5.4.3 or earlier.

The CVSS 3.1 base score is 7.1 (High) with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L: network-reachable, low complexity, and no privileges required, but exploitation requires user interaction (UI:R) - the victim must click a malicious link or visit an attacker-controlled page. The scope change (S:C) and low-but-present impact across confidentiality, integrity, and availability elevate the score above a typical self-contained reflected XSS. No EPSS score was provided in the input, and there is no KEV listing and no evidence of a public POC, so real-world exploitation pressure appears low despite the High CVSS; reflected XSS in a themed WordPress plugin is more consistent with targeted phishing-style abuse than automated mass exploitation. The dependence on user interaction is the primary factor limiting realistic risk.

An attacker crafts a URL targeting the vulnerable tagDiv Composer parameter with an embedded JavaScript payload and delivers it to a logged-in site administrator or editor via phishing email or a malicious page. When the victim clicks the link, the payload reflects into the response and executes in their browser under the site's origin, letting the attacker run actions in the victim's authenticated session such as reading page content or triggering privileged operations. No public exploit code has been identified, and the attack depends entirely on the victim's interaction with the crafted link.