PT-2026-61537 · WordPress · Tag Groups

Juyaz · CVE-2026-9833 · Published 2026-07-20 · Updated 2026-07-20

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Tag Groups versions prior to 2.2.0

Description An issue exists where the plugin fails to properly escape an AJAX parameter before reflecting it in the response body served with an HTML content type. This allows unauthenticated attackers to execute arbitrary JavaScript in the browser of a logged-in user who possesses the edit pages capability (Editor or higher) if they are tricked into following a crafted link.

Recommendations Update to version 2.2.0 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-9833

Affected Products

Tag Groups

References · 3

• 🔥 https://wpscan.com/vulnerability/75792c33-2d9d-46db-a98c-00ec40951099 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-9833 · Security Note
• https://twitter.com/VulmonFeeds/status/2079107372476166322 · Twitter Post