The Tag Groups WordPress plugin, for versions earlier than 2.2.0, fails to escape the AJAX parameter 'tag_groups_task'. When an attacker supplies a crafted value via this parameter, the plugin reflects it directly in the HTML response served to the browser. As a result, an unauthenticated attacker can embed arbitrary JavaScript that will run in the context of any logged‑in user who has the edit_pages capability (Editors or higher) who follows the crafted link. This flaw is a classic reflected XSS vulnerability (CWE‑79).

WordPress deployments that have the Tag Groups plugin installed with a release below 2.2.0 are affected. The vulnerability does not depend on the version of WordPress core; any site hosting the plugin in a pre‑2.2.0 state is susceptible, regardless of hosting environment or server configuration.

The flaw carries a CVSS score of 7.1, indicating high severity, and an EPSS score of less than 1 %, suggesting that exploitation in the wild has been limited to date. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the issue by luring a user with edit_pages rights to click a crafted link containing a malicious value in the tag_groups_task parameter; the resulting browser‑based code execution occurs only when the user is logged in and has sufficient privileges. The likelihood of exploitation is low to moderate due to the need for user interaction, but the potential impact on the affected account remains significant.