EUVD-2026-43380Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious cloud-library input/link
-
DeliveryDeliver to logged-in admin
-
ExploitAdmin interaction triggers DOM sink
-
ExecutionUnsanitized payload executes in browser
-
ImpactHijack session or create rogue admin
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires victim interaction (CVSS UI:R) - a user, most impactfully an authenticated WordPress administrator, must load or interact with attacker-controlled input processed by the td-cloud-library client-side rendering code, so this is not fully hands-off. No authentication is required of the attacker (PR:N), and the vector is network-reachable (AV:N) with low complexity (AC:L). The key limiting factors are: the target site must run the tagDiv Cloud Library plugin at version 3.9.4 or earlier (a plugin bundled with tagDiv premium themes, not universally installed), and a privileged user must be lured into triggering the DOM sink for high-value impact. Because it is DOM-based, the payload executes in the browser and may not appear in server-side logs. |
| Impact | Signals are moderate and internally consistent rather than alarming. The CVSS 3.1 base score of 7.1 is driven by network reachability (AV:N), low complexity (AC:L), no privileges (PR:N) and a changed scope (S:C), but is tempered by required user interaction (UI:R) and only Low impact to confidentiality, integrity and availability. No EPSS score, KEV entry, or POC was provided, so there is no evidence of active exploitation or automatability; the intelligence originates from a single source (Patchstack). This places the vulnerability in the 'patch on a normal cycle' tier: real and worth fixing given the plugin's tie to popular themes, but not an emergency compared to unauthenticated RCE or actively-exploited flaws. DOM-based XSS also means detection at the network/WAF layer is harder, which is a mild aggravating factor. |
| Exploit ScenarioDerived | An attacker crafts a malicious cloud-library asset or a link/input that, when loaded and interacted with by a logged-in WordPress administrator, causes the plugin's client-side code to write an unsanitized payload into the DOM. The script then runs in the admin's session context and, because scope is changed, can create a rogue admin account or exfiltrate session tokens. No public PROC/PoC is available at time of analysis, and the UI:R requirement means the victim must perform some interaction for the attack to succeed. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 13, 2026
Stored/DOM-based cross-site scripting in the tagDiv Cloud Library (td-cloud-library) WordPress plugin, versions up to and including 3.9.4, allows remote unauthenticated attackers to execute arbitrary JavaScript in a victim's browser when the victim interacts with a crafted input, per the CVSS PR:N/UI:R vector. Because the scope is changed (S:C), the injected script can affect resources beyond the vulnerable component - for example hijacking an authenticated administrator session. Reported by Patchstack; no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
RemediationAI
No vendor-released patch version is identified in the available data; the advisory indicates the flaw affects up to and including 3.9.4, so administrators should upgrade to the next release above 3.9.4 once tagDiv publishes it and monitor the Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/td-cloud-library/vulnerability/wordpress-tagdiv-cloud-library-plugin-3-9-4-cross-site-scripting-xss-vulnerability) and tagDiv's theme update channel for the fixed build. As compensating controls until a fix is applied, deploy a WordPress-aware WAF or virtual patch (Patchstack offers one for this CVE) to filter XSS payloads, restrict wp-admin and the plugin's template-loading endpoints to trusted IPs to reduce the chance an administrator triggers the payload, and ensure administrators avoid interacting with untrusted cloud-library content; note that WAF rules against DOM-based XSS are less reliable since the sink executes client-side, and IP restrictions may hinder legitimate remote editors.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The tagDiv Cloud Library is a companion plugin used by tagDiv's commercial WordPress themes (notably Newspaper and Newsmag) to fetch and render remote demo/template assets. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), realized here as DOM-based XSS: client-side JavaScript writes attacker-influenceable data into the page DOM without proper sanitization or output encoding, so a payload is executed by the browser rather than reflected purely server-side. The single CPE, cpe:2.3:a:tagdiv:tagdiv_cloud_library:*:*:*:*:*:*:*:*, confirms the affected component is the plugin itself across all versions up to the fixed release.
Know when Tagdiv Cloud Library gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Unauthenticated network DOM-XSS needing victim interaction (UI:R); scope changes to the browser session (S:C) with limited C/I/A impact typical of XSS, matching the reported vector.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tagDiv tagDiv Cloud Library td-cloud-library allows DOM-Based XSS.This issue affects tagDiv Cloud Library: from n/a through <= 3.9.4.
Executive ViewAI
The tagDiv Cloud Library WordPress plugin (versions up to 3.9.4) contains a stored cross-site scripting vulnerability allowing unauthenticated attackers to inject malicious scripts that can hijack authenticated administrator sessions and compromise website integrity. Organizations running this plugin face immediate risk of unauthorized site modification, data exfiltration, and loss of administrative control.
If plugin removal is not immediately feasible: (1) Deploy WAF rules to detect and block XSS injection attempts against known vulnerable input vectors; (2) Enforce multi-factor authentication for all WordPress administrator accounts and restrict admin console access via IP allowlist; (3) Enable detailed logging and real-time alerting on all administrator login events and privilege escalations; (4) Conduct weekly access log reviews for indicators of compromise. These interim controls significantly reduce but do not eliminate risk; plugin replacement remains necessary for full remediation.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
GitHub PoC
Exploit-DB