tagDiv Composer EUVD-2026-65290

Exploitation requires an authenticated WordPress user account with at minimum Contributor-level privileges - this is a hard prerequisite enforced by PR:L in the CVSS vector. The attacker must be able to create or edit a post or page that contains the [vc_raw_html] shortcode, meaning the tagDiv Composer plugin must be active and the shortcode must be available to the attacker's role. Exploitation of the stored payload against a privileged victim additionally requires that a higher-privilege user (Editor, Administrator) views, previews, or otherwise loads the injected page in their browser; this is the cross-site trigger, captured by S:C in the CVSS. Factors that limit real-world exploitability: sites where Contributor-level registration is closed or controlled reduce attacker access; sites where post review workflows do not expose pending posts to admins reduce victim exposure; and Content Security Policy headers that block inline script execution would mitigate JavaScript execution even if the payload is stored.

The CVSS 3.1 score of 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) accurately reflects the main risk constraints: PR:L limits exploitation to authenticated Contributor-level or higher users, and C:L/I:L reflects the limited but real browser-scope impact of stored XSS. The S:C (Changed Scope) metric correctly captures that the primary victims are not the WordPress server but users' browsers. No KEV listing and no confirmed POC mean this is not confirmed as actively exploited. EPSS data was not provided in the intelligence feed, so exploitation probability cannot be quantified from that signal. The most realistic risk materialises in multi-author WordPress environments (news sites, magazines) where untrusted contributors can draft and submit posts for editorial review: an attacker can target privileged reviewers (Editors, Admins) whose browsers execute the payload on preview, potentially enabling session hijack or privilege escalation within WordPress. For single-author or tightly access-controlled sites, real-world risk is substantially lower than the base CVSS suggests.

An attacker registers or compromises a WordPress Contributor account on a site using tagDiv Composer, then creates or edits a post with a shortcode such as [vc_raw_html]<base64-encoded-script-payload>[/vc_raw_html]. The base64 payload encodes a script tag that steals the visitor's session cookie or silently creates a rogue admin account via the WordPress REST API. When an Editor or Administrator previews or publishes the post, the script executes in their browser in the context of the WordPress site, granting the attacker effective admin-level control. No POC code has been identified in the available intelligence, but the base64-bypass technique is publicly documented in the WordPress security community.