CVE-2026-9833— Tag Groups < 2.2.0 tag_groups_task参数反射型XSS漏洞
Possible ATT&CK Techniques 1AI
T1059 · Command and Scripting InterpreterAffected Version Matrix 1
| ベンダー | プロダクト | Version Range | ステータス |
|---|---|---|---|
| Unknown | Tag Groups is the Advanced Way to Display Your Taxonomy Terms | < 2.2.0 | affected |
新しい脆弱性情報の通知を購読するログインして購読
I. CVE-2026-9833の基本情報
脆弱性情報
脆弱性についてご質問がありますか？Shenlongの分析が参考になるかご確認ください！
Shenlongの10の質問を表示 ↗ 高度な大規模言語モデル技術を使用していますが、出力には不正確または古い情報が含まれる可能性があります。Shenlongはデータの正確性を確保するよう努めていますが、実際の状況に基づいて検証・判断してください。
脆弱性タイトル
Tag Groups < 2.2.0 - Reflected XSS via 'tag_groups_task' Parameter
ソース: NVD (National Vulnerability Database)
脆弱性説明
The Tag Groups is the Advanced Way to Display Your Taxonomy Terms WordPress plugin before 2.2.0 does not properly escape one of its AJAX parameters before reflecting it in the response body served with an HTML content type, allowing unauthenticated attackers to execute arbitrary JavaScript in the browser of a logged-in user with `edit_pages` capability (Editor or higher) who is tricked into following a crafted link.
ソース: NVD (National Vulnerability Database)
CVSS情報
N/A
ソース: NVD (National Vulnerability Database)
脆弱性タイプ
N/A
ソース: NVD (National Vulnerability Database)
影響を受ける製品
| ベンダー | プロダクト | 影響を受けるバージョン | CPE | 購読 |
|---|---|---|---|---|
| Unknown | Tag Groups is the Advanced Way to Display Your Taxonomy Terms | 0 ~ 2.2.0 | - |
II. CVE-2026-9833の公開POC
| # | POC説明 | ソースリンク | Shenlongリンク |
|---|
AI生成POCプレミアム
公開POCは見つかりませんでした。
ログインしてAI POCを生成III. CVE-2026-9833のインテリジェンス情報
请登录查看更多情报信息。
CVE-2026-9833 厂商安全公告 (1)
- 🔗 Tag Groups < 2.2.0 – Reflected XSS via 'tag_groups_task' Parameter | CVE 2026-9833 | Plugin Vulnerabilities 記事全文を読む exploitvdb-entrytechnical-description
Same Patch Batch · Unknown · 2026-07-20 · 18 CVEs total
| CVE-2026-12972 | PayPlus Payment Gateway < 8.2.2 - Unauthenticated Order Payment Metadata Tampering | |
| CVE-2026-8825 | Elementor < 4.1.4 - Contributor+ Sensitive Information Disclosure via REST API | |
| CVE-2026-13156 | MailerSend - Official SMTP Integration < 1.0.8 - Settings Deletion and Plugin Deactivation | |
| CVE-2026-13147 | Kirki < 6.0.12 - Unauthenticated Server-Side Request Forgery via kirki_get_apis | |
| CVE-2026-13142 | Passwordless Login by VentraConnect < 1.4.1 - Unauthenticated Account Takeover via Email O | |
| CVE-2026-13432 | ThumbPress < 6.2.2 - Subscriber+ Plugin Deactivation | |
| CVE-2026-12898 | All-in-One WP Migration and Backup < 7.106 - Unauthenticated Arbitrary-Location Log File W | |
| CVE-2026-12970 | LearnPress < 4.4.1 - Reflected XSS via c_search | |
| CVE-2026-12973 | PayPlus Payment Gateway < 8.2.2 - Unauthenticated Order Key Disclosure and Order Status Mo | |
| CVE-2026-11349 | Modern Events Calendar (Lite & Pro) < 7.34.0 - Unauthenticated SQL Injection via mec_list_ | |
| CVE-2026-12724 | Kirki < 6.0.12 - Unauthenticated HTML Injection in Password Reset Email via kirki-forgot-p | |
| CVE-2026-12723 | Kirki < 6.0.12 - Unauthenticated Arbitrary Comment Modification and Moderation Bypass via | |
| CVE-2026-12592 | SlimStat Analytics < 5.5.0 - Unauthenticated Stored XSS via CF-IPCountry Header | |
| CVE-2026-11868 | WP Travel < 11.7.1 - Unauthenticated Arbitrary Booking Cancellation | |
| CVE-2026-10081 | Unlimited Elements for Elementor < 2.0.11 - Unauthenticated Stored XSS via Google Reviews | |
| CVE-2026-10724 | Reviews Feed < 2.6.5 - Unauthenticated Stored Arbitrary Shortcode Execution via Google Rev | |
| CVE-2026-10755 | All in One SEO < 4.9.9 – Contributor+ Incorrect Authorization via AI Integration |
IV. 関連脆弱性
同じベンダー: Unknown
- CVE-2026-14184
Academy LMS < 3.8.1 - Subscriber+ Cross-User Lesson Note and - CVE-2026-14185
WPBot AI ChatBot < 8.2.0 - Subscriber+ RAG Settings Update - CVE-2026-14183
Classified Listing < 5.3.9 - Subscriber+ Payment Receipt Dis - CVE-2026-13694
Bit Form < 3.1.0 - Unauthenticated Workflow Trigger via Auth - CVE-2026-8082
Bpost Shipping Platform < 3.2.3 - Unauthenticated SQL Inject
V. CVE-2026-9833へのコメント
まだコメントはありません