An unauthenticated reflected Cross-Site Scripting vulnerability in the Tag Groups WordPress plugin allows remote attackers to execute arbitrary JavaScript in the browser of a logged-in user.

This is a reflected Cross-Site Scripting (XSS) vulnerability caused by insufficient sanitization of AJAX parameters. The vulnerability is exploitable by unauthenticated attackers who trick a user with high-level privileges, such as an Editor, into interacting with a malicious link.

The vulnerability carries a CVSS score of 7.1, classifying it as High severity. Successful exploitation allows an attacker to hijack active user sessions, perform actions on behalf of the victim, or redirect users to malicious sites, which may lead to unauthorized data access or administrative configuration changes.

Immediate Action: Update the Tag Groups plugin to version 2.2.0 or later immediately.

Proactive Monitoring: Review web server access logs for suspicious URL patterns containing unexpected script tags or encoded characters directed at the plugin's AJAX endpoints.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common XSS injection patterns and malicious script payloads.

Public Exploit Available: No (per available data).

Given the High severity of this flaw, administrators should prioritize updating the plugin. Failure to patch allows unauthenticated attackers to target administrative users, potentially compromising the integrity of the entire WordPress installation.