WordPress Plugin Vulnerabilities

Tag Groups < 2.2.0 - Reflected XSS via 'tag_groups_task' Parameter

Description

The plugin does not properly escape one of its AJAX parameters before reflecting it in the response body served with an HTML content type, allowing unauthenticated attackers to execute arbitrary JavaScript in the browser of a logged-in user with `edit_pages` capability (Editor or higher) who is tricked into following a crafted link.

Proof of Concept

Affects Plugins

Plugin icon
tag-groups
Fixed in 2.2.0

References

CVE
CVE-2026-9833

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
7.1 (high)

Miscellaneous

Original Researcher
Juyaz
Submitter
Juyaz
Verified
Yes
WPVDB ID
75792c33-2d9d-46db-a98c-00ec40951099

Timeline

Publicly Published
2026-06-29 (about 22 days ago)
Added
2026-06-29 (about 21 days ago)
Last Updated
2026-06-29 (about 21 days ago)

Other

Published
Title
Published
2025-04-01
Title
Client Showcase <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2021-09-21
Title
Special Text Boxes < 5.9.110 - Admin+ Stored Cross-Site Scripting
Published
2024-08-16
Title
Ultimate Store Kit Elementor Addons < 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2026-04-14
Title
VI: Include Post By <= 0.4.200706 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'class_container' Shortcode Attribute
Published
2024-12-11
Title
Revi.io < 5.8.0 - Reflected Cross-Site Scripting