CVE-2026-9833: Unauthenticated XSS in Tag Groups WordPress Plugin
The CVE-2026-9833 vulnerability is a high-severity (CVSS 7.1) unauthenticated stored cross-site scripting (XSS) flaw in the Tag Groups WordPress plugin prior to version 2.2.0. An attacker can exploit this vulnerability by crafting a link that, when followed by a logged-in user with 'edit_pages' capability (Editor or higher), allows the execution of arbitrary JavaScript in the user's browser. This could lead to unauthorized actions within the WordPress dashboard. Immediate action is recommended to upgrade to version 2.2.0 or later.