The vulnerability CVE-2025-53222 in tagDiv Opt-In Builder (<= 1.7.3) is caused by improper neutralization of input during web page generation, leading to reflected Cross-site Scripting (XSS) in the td-subscription feature. This allows attackers to inject malicious scripts that execute in the context of the victim's browser when they interact with crafted links or inputs. The CVSS 3.1 vector indicates the attack can be performed remotely over the network without privileges but requires user interaction. The vulnerability impacts confidentiality, integrity, and availability to a limited extent.

Successful exploitation of this vulnerability can lead to execution of arbitrary scripts in the context of the affected web application, potentially allowing attackers to steal user credentials, perform actions on behalf of the user, or disrupt availability. The CVSS score of 7.1 reflects a high impact on confidentiality, integrity, and availability, though exploitation requires user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or limiting use of the td-subscription feature or applying web application firewall (WAF) rules to detect and block reflected XSS attempts. Monitor vendor channels for updates and apply patches promptly once available.