WordPress Tag Groups < 2.2.0 - Reflected Cross-Site Scripting

The Tag Groups WordPress plugin 2.2.0 contains a stored XSS caused by improper escaping of an AJAX parameter reflected in an HTML response, letting unauthenticated attackers execute arbitrary JavaScript in browsers of logged-in users with editpages capability, exploit requires victim interaction...

CVE-2026-9833

CVE-2026-9833 CVE ID: CVE-2026-9833 Vulnerability Type: Cross-Site Scripting XSS – Reflected XSS CWE: CWE-79 – Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' Severity: High CISA ADP CVSS v3.1: 7.1 Overview CVE-2026-9833 affects the Tag Groups – Advanced Way to...

Exploit for CVE-2026-9833

CVE-2026-9833 CVE ID: CVE-2026-9833 Vulnerability Type: Cross...

CVE-2026-35590

CVE-2026-35590 affects libvips’ EXIF decoder. Versions

CVE-2026-35590

libvips is a fast image processing library with low memory needs. The EXIF decoder within libvips versions before and including 8.18.1 was not verifying the range of EXIF tag groups before passing data to libexif, leading to a possible null pointer dereference and crash. This has been patched in...

CVE-2026-9833

The Tag Groups is the Advanced Way to Display Your Taxonomy Terms WordPress plugin before 2.2.0 does not properly escape one of its AJAX parameters before reflecting it in the response body served with an HTML content type, allowing unauthenticated attackers to execute arbitrary JavaScript in the...

CVE-2026-9833 Tag Groups < 2.2.0 - Reflected XSS via 'tag_groups_task' Parameter

The Tag Groups is the Advanced Way to Display Your Taxonomy Terms WordPress plugin before 2.2.0 does not properly escape one of its AJAX parameters before reflecting it in the response body served with an HTML content type, allowing unauthenticated attackers to execute arbitrary JavaScript in the...

CVE-2026-9833

The Tag Groups is the Advanced Way to Display Your Taxonomy Terms WordPress plugin, in versions before 2.2.0 , is vulnerable to Reflected Cross-Site Scripting (XSS) (CWE-79). The root cause is the improper escaping of an AJAX parameter (specifically the tag_groups_task parameter) which is reflect...

EUVD-2026-45893

The Tag Groups is the Advanced Way to Display Your Taxonomy Terms WordPress plugin before 2.2.0 does not properly escape one of its AJAX parameters before reflecting it in the response body served with an HTML content type, allowing unauthenticated attackers to execute arbitrary JavaScript in the...

CVE-2026-9833

The Tag Groups is the Advanced Way to Display Your Taxonomy Terms WordPress plugin before 2.2.0 does not properly escape one of its AJAX parameters before reflecting it in the response body served with an HTML content type, allowing unauthenticated attackers to execute arbitrary JavaScript in the...

CVE-2026-9833 Tag Groups < 2.2.0 - Reflected XSS via 'tag_groups_task' Parameter

The Tag Groups is the Advanced Way to Display Your Taxonomy Terms WordPress plugin before 2.2.0 does not properly escape one of its AJAX parameters before reflecting it in the response body served with an HTML content type, allowing unauthenticated attackers to execute arbitrary JavaScript in the...

CVE-2026-9833: Improper Neutralization of Input During Web Page Generation

The Tag Groups is the Advanced Way to Display Your Taxonomy Terms WordPress plugin before 2.2.0 does not properly escape one of its AJAX parameters before reflecting it in the response body served with an HTML content type, allowing unauthenticated attackers to execute arbitrary JavaScript in the...

PT-2026-61537

Name of the Vulnerable Software and Affected Versions Tag Groups versions prior to 2.2.0 Description An issue exists where the plugin fails to properly escape an AJAX parameter before reflecting it in the response body served with an HTML content type. This allows unauthenticated attackers to...

BIT-DISCOURSE-2026-47264 Discourse: Don't leak restricted tag group names via tag info

Discourse is an open-source discussion platform. From versions 2026.1.0 to before 2026.1.4, 2026.3.0 to before 2026.3.1, and 2026.4.0 to before 2026.4.1, DetailedTagSerializertaggroupnames returned every tag group a tag belonged to without filtering against the requesting user's visibility. With...

CVE-2026-47264

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to before 2026.4.1, DetailedTagSerializertaggroupnames returned every tag group a tag belonged to without filtering against the requesting...

CVE-2026-47264 Discourse: Don't leak restricted tag group names via tag info

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to before 2026.4.1, DetailedTagSerializertaggroupnames returned every tag group a tag belonged to without filtering against the requesting...

EUVD-2026-36561

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to before 2026.4.1, DetailedTagSerializertaggroupnames returned every tag group a tag belonged to without filtering against the requesting...

CVE-2026-47264

CVE-2026-47264 affects Discourse releases 2026.1.0–2026.1.3, 2026.3.0–2026.3.0x (up to 2026.3.0-latest until 2026.3.1), and 2026.4.0–2026.4.0x (up to 2026.4.0-latest until 2026.4.1). The root cause is that DetailedTagSerializer#tag_group_names returned every tag group a tag belonged to without fi...

CVE-2026-47264 Discourse: Don't leak restricted tag group names via tag info

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to before 2026.4.1, DetailedTagSerializertaggroupnames returned every tag group a tag belonged to without filtering against the requesting...

PT-2026-30241

Name of the Vulnerable Software and Affected Versions Discourse versions 2026.1.0 through before 2026.1.3 Discourse versions 2026.2.0 through before 2026.2.2 Discourse versions 2026.3.0 through before 2026.3.0 Description Discourse, an open-source discussion platform, contains an authorization...