EUVD-2026-45893
GHSA-mcx6-9qf4-cx6p
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Unauthenticated reflected XSS (PR:N) reachable over the network (AV:N/AC:L) but needs a privileged victim to click (UI:R); script runs in admin context so scope changes (S:C) with partial C/I/A.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Lifecycle Timeline
4DescriptionCVE.org
The Tag Groups is the Advanced Way to Display Your Taxonomy Terms WordPress plugin before 2.2.0 does not properly escape one of its AJAX parameters before reflecting it in the response body served with an HTML content type, allowing unauthenticated attackers to execute arbitrary JavaScript in the browser of a logged-in user with edit_pages capability (Editor or higher) who is tricked into following a crafted link.
Articles & Coverage 1
AnalysisAI
Reflected cross-site scripting in the WordPress plugin 'Tag Groups is the Advanced Way to Display Your Taxonomy Terms' before version 2.2.0 allows unauthenticated attackers to run arbitrary JavaScript in the browser of a logged-in Editor (or higher) who clicks a crafted link, because one AJAX parameter is reflected unescaped into an HTML-typed response. Publicly available exploit code exists (published by WPScan), but the flaw is not listed in CISA KEV and carries a low EPSS score (0.17%, 7th percentile), indicating no evidence of widespread active exploitation. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to lure an authenticated WordPress user who holds the edit_pages capability (Editor role or higher) into clicking a crafted link that targets the vulnerable AJAX parameter - the victim must be logged in and must perform this interaction (UI:R). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score is 7.1 (High) with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L - network-reachable, low complexity, no privileges required for the attacker, but user interaction is mandatory and the scope change reflects script executing in the trusted admin context. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker crafts a URL targeting the plugin's vulnerable AJAX endpoint with a malicious script payload in the reflected parameter and sends it (via email, chat, or a comment) to a site Editor. When the logged-in Editor clicks the link, the unescaped payload is reflected into the HTML response and executes in their authenticated session, letting the attacker exfiltrate the session/nonce or perform actions such as creating content or planting a persistent backdoor. … |
| Remediation | Vendor-released patch: upgrade the plugin to version 2.2.0 or later, which properly escapes the reflected AJAX parameter; this is the primary and complete fix and should be applied through the WordPress plugin updater. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all WordPress deployments to identify installations running Tag Groups and document current versions in use. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today