The tagDiv Composer plugin for WordPress suffers from a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of user-supplied input in the 'single' module. Authenticated attackers with author-level privileges or above can inject arbitrary web scripts that persist in pages and execute in the context of users visiting those pages. This vulnerability affects all versions up to 4.8. The CVSS 3.1 base score is 5.5, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, and partial confidentiality and integrity impact. No patch or remediation details are currently available from the vendor or other sources.

Successful exploitation allows an authenticated user with author-level access or higher to inject persistent malicious scripts into pages generated by the tagDiv Composer plugin. These scripts execute in the browsers of users who visit the affected pages, potentially leading to partial confidentiality and integrity compromise of user data within the context of the vulnerable site. There is no impact on availability reported. No known exploits are currently observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, limit author-level access to trusted users only and consider disabling or restricting use of the 'single' module in tagDiv Composer. Monitor vendor communications for updates regarding patches or official mitigations.