CVE-2026-9833
Deferred Deferred - Pending Action

Reflected Cross-Site Scripting in Tag Groups WordPress Plugin

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: WPScan

Description
The Tag Groups is the Advanced Way to Display Your Taxonomy Terms WordPress plugin before 2.2.0 does not properly escape one of its AJAX parameters before reflecting it in the response body served with an HTML content type, allowing unauthenticated attackers to execute arbitrary JavaScript in the browser of a logged-in user with `edit_pages` capability (Editor or higher) who is tricked into following a crafted link.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-20
Last Modified
2026-07-20
Generated
2026-07-21
AI Q&A
2026-07-20
EPSS Evaluated
N/A
NVD
CVE-2026-9833
EUVD
EUVD-2026-45893

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
tag_groups tag_groups to 2.2.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a reflected Cross-Site Scripting (XSS) vulnerability in the WordPress plugin Tag Groups affecting versions before 2.2.0. The plugin fails to properly escape an AJAX parameter named 'tag_groups_task' before reflecting it in an HTML response. This allows unauthenticated attackers to inject and execute arbitrary JavaScript in the browser of a logged-in user with the 'edit_pages' capability if they click a specially crafted link.

Detection Guidance

To detect this vulnerability, check if the WordPress plugin 'Tag Groups' is installed and if its version is below 2.2.0. You can use WPScan to identify vulnerable versions with the command: wpscan --url <target_url> --enumerate vp,vt. Alternatively, inspect the plugin files for the presence of the 'tag_groups_task' parameter in AJAX calls.

Impact Analysis

An attacker could trick a logged-in user with Editor or higher privileges into clicking a malicious link. This could allow the attacker to execute arbitrary JavaScript in the victim's browser, potentially leading to session hijacking, data theft, or unauthorized actions on the WordPress site.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, which may violate GDPR or HIPAA requirements for data protection and user privacy. Organizations using the affected plugin versions may face compliance risks if user data is compromised through this exploit.

Mitigation Strategies

Immediately update the 'Tag Groups' plugin to version 2.2.0 or later. If updating is not possible, consider disabling the plugin temporarily until the update is applied. Ensure all users with 'edit_pages' capability are aware of the risk and avoid clicking untrusted links.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-9833. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart