What is the CVSS score of EUVD-2026-45893?

EUVD-2026-45893 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of Tag Groups are affected by EUVD-2026-45893?

The WordPress plugin Tag Groups (versions before 2.2.0) contains a cross-site scripting vulnerability that allows attackers to hijack editorial and administrator sessions by tricking users into…. A patch is available.

Is there a public PoC exploit available for EUVD-2026-45893?

Yes, a public proof-of-concept exploit is available for EUVD-2026-45893. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate EUVD-2026-45893?

Within 24 hours, audit all WordPress deployments to identify installations running Tag Groups and document current versions in use. Within 7 days, deploy Tag Groups version 2.2.0 or later to all affected systems, prioritizing production environments with active content management. Within 30 days, verify patch deployment through automated scanning, confirm no instances remain on vulnerable versions, and distribute security awareness guidance to editorial staff regarding phishing attacks targeting administrative access.

Tag Groups EUVD-2026-45893

| CVE-2026-9833 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-20 WPScan

GHSA-mcx6-9qf4-cx6p

WordPress XSS Tag Groups Is The Advanced Way To Display Your Taxonomy Terms Unknown

7.1

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

7.1 HIGH

Unauthenticated reflected XSS (PR:N) reachable over the network (AV:N/AC:L) but needs a privileged victim to click (UI:R); script runs in admin context so scope changes (S:C) with partial C/I/A.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 09:29 vuln.today

Patch available

Jul 20, 2026 - 09:17 EUVD

CVE Published

Jul 20, 2026 - 06:00 cve.org

HIGH 7.1

CVE Published

Jul 20, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

The Tag Groups is the Advanced Way to Display Your Taxonomy Terms WordPress plugin before 2.2.0 does not properly escape one of its AJAX parameters before reflecting it in the response body served with an HTML content type, allowing unauthenticated attackers to execute arbitrary JavaScript in the browser of a logged-in user with edit_pages capability (Editor or higher) who is tricked into following a crafted link.

Articles & Coverage 1

News 6 New WordPress Vulnerabilities - 1 Critical, 5 High, All With POC Jul 21, 2026

AnalysisAI

Reflected cross-site scripting in the WordPress plugin 'Tag Groups is the Advanced Way to Display Your Taxonomy Terms' before version 2.2.0 allows unauthenticated attackers to run arbitrary JavaScript in the browser of a logged-in Editor (or higher) who clicks a crafted link, because one AJAX parameter is reflected unescaped into an HTML-typed response. Publicly available exploit code exists (published by WPScan), but the flaw is not listed in CISA KEV and carries a low EPSS score (0.17%, 7th percentile), indicating no evidence of widespread active exploitation. Successful exploitation can hijack an editorial session, letting the attacker act with the victim's WordPress capabilities.

Technical ContextAI

The affected component is a WordPress plugin that renders taxonomy terms (tags) in grouped displays, and the vulnerable surface is one of its admin-ajax.php AJAX endpoints. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation): the plugin echoes a request parameter back into a response served with an HTML content type without HTML-escaping it, so injected markup/script is parsed by the browser rather than treated as inert text. Because the payload arrives in the request and is reflected immediately in the response (not stored), this is a reflected XSS requiring the victim to load an attacker-crafted URL. The CPE 'cpe:2.3:a:unknown:tag_groups_is_the_advanced_way_to_display_your_taxonomy_terms:*' covers all versions prior to the 2.2.0 fix; the vendor namespace is recorded as 'unknown' in NVD's CPE data.

RemediationAI

Vendor-released patch: upgrade the plugin to version 2.2.0 or later, which properly escapes the reflected AJAX parameter; this is the primary and complete fix and should be applied through the WordPress plugin updater. Review the WPScan advisory (https://wpscan.com/vulnerability/75792c33-2d9d-46db-a98c-00ec40951099/) for confirmation. If immediate upgrade is not possible, apply compensating controls: place a WAF/virtual-patch rule to block requests to the plugin's admin-ajax action carrying HTML/script metacharacters in the vulnerable parameter (trade-off: rule may need tuning to avoid breaking legitimate tag-display AJAX calls), restrict access to /wp-admin and admin-ajax.php by IP or authentication proxy where feasible, and advise Editor-and-above users not to follow untrusted links pointing at the site (trade-off: awareness-based, not a technical guarantee). Deactivating the plugin until patched eliminates the exposure at the cost of losing the taxonomy-display feature.