The vulnerability in the Tag Groups WordPress plugin arises from improper escaping of an AJAX parameter in responses served with an HTML content type. This flaw enables unauthenticated attackers to inject and execute arbitrary JavaScript code in the context of logged-in users who have the edit_pages capability, such as Editors or administrators, if they are tricked into clicking a maliciously crafted link. This is a stored reflected Cross-Site Scripting (CWE-79) vulnerability affecting versions prior to 2.2.0 of the plugin.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browser of privileged WordPress users (Editors or higher). This can lead to session hijacking, privilege escalation, or other malicious actions performed with the victim's credentials. The attack requires the victim to be logged in with sufficient privileges and to interact with a crafted link.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to users with edit_pages capability and avoid clicking suspicious links. Monitor the vendor's updates for a security patch addressing this vulnerability.