What is the CVSS score of EUVD-2026-43379?

EUVD-2026-43379 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.3%.

Which versions of Tagdiv Opt In Builder are affected by EUVD-2026-43379?

The tagDiv Opt-In Builder WordPress plugin (td-subscription) contains a cross-site scripting vulnerability affecting versions through 1.7.4 that allows remote attackers to inject malicious code…

How to fix or mitigate EUVD-2026-43379?

Within 24 hours, audit all WordPress installations to identify deployments of td-subscription plugin versions 1.7.4 or earlier, and disable or remove the plugin immediately as an emergency measure. Over the next 7 days, monitor the tagDiv vendor advisory and plugin repository for patch announcements; simultaneously implement interim technical controls including Web Application Firewall (WAF) rules targeting XSS payload patterns and Content Security Policy (CSP) headers to restrict inline script execution. Within 30 days of patch availability, apply the vendor-released patch after staging testing, or migrate to an alternative subscription/opt-in solution; conduct log analysis to identify any exploitation attempts that occurred during the unpatched window.

Tagdiv Opt In Builder EUVD-2026-43379

| CVE-2026-57732 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-13 Patchstack

XSS Tagdiv Opt In Builder

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Primary rating from Vendor (Patchstack) · only source for this CVE.

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 10:42 vuln.today

CVE Published

Jul 13, 2026 - 08:41 cve.org

HIGH 7.1

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tagDiv tagDiv Opt-In Builder td-subscription allows DOM-Based XSS.This issue affects tagDiv Opt-In Builder: from n/a through <= 1.7.4.

AnalysisAI

DOM-based cross-site scripting in the tagDiv Opt-In Builder WordPress plugin (td-subscription) affects all versions up to and including 1.7.4, allowing remote unauthenticated attackers to execute arbitrary JavaScript in a victim's browser when the victim interacts with a crafted link or page. The CVSS 3.1 scope-changed vector (7.1) reflects that injected script runs in the site's origin and can affect resources beyond the vulnerable component. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Recommended ActionAI

Within 24 hours, audit all WordPress installations to identify deployments of td-subscription plugin versions 1.7.4 or earlier, and disable or remove the plugin immediately as an emergency measure. …

Threat intelligence, references, and detailed analysis are available after sign-in.