Simple Bespoke WordPress Integration Plugin
It's a good idea with frameworks to follow the method calls to see what you're actually doing, Wordpress is one of the most exploited frameworks out there and thus has fairly good security improvements. Here is the Wordpress WP_Query class you're invoking (assuming you have the latest code pulled). 

It looks like the __construct calls $this->query on your $params, which calls wp_parse_args(). (If you already have the code pulled, Grep can help finding where in the code the class lives).
https://github.com/WordPress/WordPress/blob/master/wp-includes/class-wp-query.php

As far as security is concerned, your primary concern would be with the user supplied data $_GET['q']. If you do not feel that the WP_Query class is doing enough to sanitize the user data you can sanitize it yourself.

In your case, it looks like you only want the user to supply a integer? If that is the case you can filter. Adjust as necessary:

if (filter_var($_GET['q'], FILTER_VALIDATE_INT)) {
   // is int
}


Additional tips:
There is no reason to set $_GET['q'] to $TagNumber in your example, since you're not sanitizing it. Doing so only increases memory usage and complicates code review.

Be consistent about whether or not to clear between an if and "{". Most of the reason for clearing has to do with refactoring and applies mostly to class definitions.

There is no need to ?> close the script, it can add unintended white space.

Don't indent functions unless they are inside classes (looks to be intended for no reason).

Pick a style for naming variables, e.g. snake_case; not $TagName and $params, but $tag_name and $params

I hope this is helpful :-)