WordPress tagDiv Opt-In Builder plugin <= 1.7.3 - Reflected Cross Site Scripting (XSS) vulnerability

The impact of this XSS vulnerability is significant. An attacker could craft a malicious URL containing JavaScript code and trick a user into clicking it. Upon visiting the URL, the injected script would execute in the user's browser within the context of the tagDiv Opt-In Builder plugin. This could allow the attacker to steal cookies, hijack user sessions, deface the website, or redirect users to phishing sites. The scope of the impact depends on the privileges of the affected user and the sensitivity of the data accessible through the WordPress site. Successful exploitation could lead to complete compromise of user accounts and potentially the entire WordPress installation.

Websites using the tagDiv Opt-In Builder plugin, particularly those with user authentication or sensitive data, are at risk. Shared hosting environments where multiple websites share the same server resources are also at increased risk, as a vulnerability in one site could potentially be exploited to compromise others.

• wordpress / composer / npm:

grep -r 'td-subscription' /var/www/html/wp-content/plugins/

• wordpress / composer / npm:

wp plugin list | grep tagDiv

• wordpress / composer / npm:

wp plugin update tagDiv

• generic web: Inspect URL parameters for suspicious JavaScript code (e.g., <script>alert('XSS')</script>).

1. 2026-03-19Disclosure

   disclosure

1. Réservé2025-06-27
2. Publiée2026-03-19
3. Modifiée2026-04-28
4. EPSS mis à jour2026-03-26

The primary mitigation for CVE-2025-53222 is to immediately upgrade the tagDiv Opt-In Builder plugin to version 1.7.4 or later. If upgrading is not immediately feasible due to compatibility issues or testing requirements, consider implementing temporary workarounds. Web Application Firewalls (WAFs) can be configured to filter out potentially malicious URLs containing JavaScript code. Input validation and output encoding on the server-side can also help prevent XSS attacks, although this is a more complex solution. Regularly scan your WordPress installation for vulnerabilities using a security plugin.