This vulnerability (CVE-2025-22735) involves improper neutralization of input in the WordPress Tag Cloud Plugin – Tag Groups by Steve Burge, resulting in reflected cross-site scripting (XSS). It affects all versions up to 2.0.4. The vulnerability allows an attacker to inject malicious scripts that are reflected back to users, potentially impacting confidentiality, integrity, and availability. The CVSS v3.1 base score is 7.1, indicating high severity, with network attack vector, low attack complexity, no privileges required, user interaction required, and scope changed. No patch or vendor advisory is currently available.

Successful exploitation of this reflected XSS vulnerability can lead to limited confidentiality, integrity, and availability impacts, such as theft of user session data, defacement, or other malicious script execution in the context of the affected website. However, no known exploits are reported in the wild, and the impact is limited to users who interact with the maliciously crafted input.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the affected plugin version or applying web application firewall (WAF) rules to detect and block reflected XSS attempts. Avoid clicking on suspicious links that may exploit this vulnerability.