The tagDiv Composer plugin for WordPress suffers from a reflected cross-site scripting vulnerability (CWE-79) due to improper neutralization of input in the 'envato_code[]' parameter. This occurs in the on_ajax_check_envato_code function where input is not properly sanitized or escaped before being included in web page output. As a result, unauthenticated attackers can inject malicious scripts that execute in the context of users who interact with crafted URLs. This vulnerability affects all versions up to and including 5.0. The CVSS 3.1 base score is 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, no privileges required, user interaction needed, scope changed, and low impact on confidentiality and integrity with no impact on availability.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of a victim's browser session when the victim clicks a malicious link. This can lead to partial disclosure and modification of information accessible to the user within the affected site. There is no reported impact on system availability. The vulnerability requires user interaction and affects confidentiality and integrity to a limited extent.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with untrusted links that might exploit this vulnerability. Monitoring vendor channels for updates and applying any forthcoming patches promptly is recommended.