WordPress Tag Groups < 2.2.0 - Reflected Cross-Site Scripting
CVE-2026-9833
Early Release
Description
The Tag Groups WordPress plugin < 2.2.0 contains a stored XSS caused by improper escaping of an AJAX parameter reflected in an HTML response, letting unauthenticated attackers execute arbitrary JavaScript in browsers of logged-in users with edit_pages capability, exploit requires victim interaction.
Severity
High
CVSS Score
7.1
Exploit Probability
1%
Affected Product
tag-groups
Published Date
October 9, 2026
Template Author
anirbala98
CVE-2026-9833.yaml
7.1Score
CVSS Metrics
CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
CVE ID:
cve-2026-9833
CWE ID:
cwe-79
Remediation Steps
Update the Tag Groups plugin to version 2.2.0 or later.