What is the CVSS score of EUVD-2025-208858?

EUVD-2025-208858 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of Wordpress Plugin are affected by EUVD-2025-208858?

A reflected XSS vulnerability in tagDiv Composer WordPress plugin (CVE-2025-50001) affects all websites using this plugin up to version 5.4.2.

How to fix or mitigate EUVD-2025-208858?

Within 24 hours: Inventory all WordPress instances using tagDiv Composer and identify version numbers; implement Web Application Firewall (WAF) rules to block suspicious query parameters targeting the plugin. Within 7 days: Disable the tagDiv Composer plugin if non-critical, or restrict its functionality; conduct user awareness training on phishing risks from malicious links. Within 30 days: Monitor tagDiv for security updates; evaluate alternative plugins; establish a vulnerability management process for third-party WordPress plugins.

Wordpress Plugin EUVD-2025-208858

| CVE-2025-50001 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-03-19 audit@patchstack.com

WordPress XSS Wordpress Plugin

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 29, 2026 - 10:22 vuln.today

cvss_changed

EUVD ID Assigned

Mar 19, 2026 - 09:22 euvd

EUVD-2025-208858

Analysis Generated

Mar 19, 2026 - 09:22 vuln.today

CVE Published

Mar 19, 2026 - 09:16 nvd

HIGH 7.1

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tagDiv tagDiv Composer allows Reflected XSS.This issue affects tagDiv Composer: from n/a through 5.4.2.

AnalysisAI

tagDiv Composer, a WordPress plugin used by tagDiv themes, contains a reflected cross-site scripting (XSS) vulnerability that allows unauthenticated attackers to inject malicious scripts into web pages. Versions up to and including 5.4.2 are affected. The vulnerability requires user interaction (victim must click a malicious link) but can be exploited remotely without authentication, making it a moderate-severity threat with a CVSS score of 7.1.

Technical ContextAI

This vulnerability stems from improper neutralization of input during web page generation (CWE-79), commonly known as cross-site scripting. The tagDiv Composer plugin fails to properly sanitize user-supplied input before reflecting it back in HTTP responses, allowing attackers to inject arbitrary JavaScript or HTML code. The reflected XSS variant means the malicious payload is not stored on the server but instead transmitted through crafted URLs or form submissions. The affected product is identified as tagDiv Composer for WordPress, a page builder component often bundled with tagDiv themes. The vulnerability was reported by Patchstack's security audit team and assigned ENISA EUVD ID EUVD-2025-208858.

RemediationAI

Upgrade tagDiv Composer to a version newer than 5.4.2 as soon as the vendor releases a patched version, monitoring the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/td-composer/vulnerability/wordpress-tagdiv-composer-plugin-5-4-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve for update notifications. As an interim mitigation, implement web application firewall (WAF) rules to detect and block XSS attack patterns in URL parameters and form submissions, enable Content Security Policy (CSP) headers to restrict script execution to trusted sources, and educate users about the risks of clicking untrusted links. Consider restricting access to WordPress administrative interfaces to trusted IP ranges and implementing additional input validation at the web server or reverse proxy level until the vendor patch is applied.