What is CVE-2025-2890?

CVE-2025-2890 is a medium-severity vulnerability in Tagdiv Opt-in Builder, classified under SQL Injection. CVSS score: 6.5/10. Published 2025-04-30.

How severe is CVE-2025-2890?

Medium severity. CVSS v3 base score is 6.5 out of 10.

SQL Injection in Tagdiv Opt-in Builder

CVE-2025-2890

The tagDiv Opt-In Builder plugin for WordPress is vulnerable to time-based SQL Injection via the ‘subscriptionCouponId’ parameter in all versions up to, and including, 1.7 due to insufficient escaping on the user supplied parameter and lac…

Vulnerability class: SQL Injection

EPSS: 0.002 (38.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.

Affected products

Tagdiv Opt-in Builder — versions 0

Weakness classification (CWE)

CWE-89 — SQL Injection

References

www.wordfence.com/threat-intel/vulnerabilities/id/fff1cff1-6745-4124-ba93-8b074…
tagdiv.com/newspaper-changelog/
themeforest.net/item/newspaper/5489609
tagdiv.com/tagdiv-opt-in-builder/

Frequently asked questions

What is CVE-2025-2890?: CVE-2025-2890 is a medium-severity vulnerability in Tagdiv Opt-in Builder, classified under SQL Injection. CVSS score: 6.5/10. Published 2025-04-30.
How severe is CVE-2025-2890?: Medium severity. CVSS v3 base score is 6.5 out of 10.