CVE-2026-0549

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-0549", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-01-01T17:44:02.588Z", "datePublished": "2026-02-19T04:36:15.910Z", "dateUpdated": "2026-04-08T17:01:16.763Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:01:16.763Z"}, "affected": [{"vendor": "itthinx", "product": "Groups", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.10.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Groups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'groups_group_info' shortcode in all versions up to, and including, 3.10.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "Groups <= 3.10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'groups_group_info' Shortcode", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/75000e67-7914-43af-be1d-82990ada5129?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/groups/tags/3.9.0/lib/views/class-groups-shortcodes.php?marks=185#L185"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3438974%40groups&new=3438974%40groups&sfp_email=&sfph_mail=#file39"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Yudha - DJ"}], "timeline": [{"time": "2025-12-24T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2026-02-18T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-19T21:03:49.159926Z", "id": "CVE-2026-0549", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-19T21:04:08.107Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-0549", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-19T21:03:49.159926Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-19T21:04:03.176Z"}}], "cna": {"title": "Groups <= 3.10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'groups_group_info' Shortcode", "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Yudha - DJ"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "itthinx", "product": "Groups", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "3.10.0"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-12-24T00:00:00.000Z", "value": "Discovered"}, {"lang": "en", "time": "2026-02-18T00:00:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/75000e67-7914-43af-be1d-82990ada5129?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/groups/tags/3.9.0/lib/views/class-groups-shortcodes.php?marks=185#L185"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3438974%40groups&new=3438974%40groups&sfp_email=&sfph_mail=#file39"}], "descriptions": [{"lang": "en", "value": "The Groups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'groups_group_info' shortcode in all versions up to, and including, 3.10.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:01:16.763Z"}}}, "cveMetadata": {"cveId": "CVE-2026-0549", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:01:16.763Z", "dateReserved": "2026-01-01T17:44:02.588Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-02-19T04:36:15.910Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Groups", "vendor": "itthinx", "versions": [{"lessThanOrEqual": "3.10.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Groups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'groups_group_info' shortcode in all versions up to, and including, 3.10.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El plugin Groups para WordPress es vulnerable a Cross-Site Scripting Almacenado a trav\u00e9s del shortcode 'groups_group_info' del plugin en todas las versiones hasta la 3.10.0, inclusive, debido a una sanitizaci\u00f3n de entrada y un escape de salida insuficientes en atributos proporcionados por el usuario. Esto hace posible que atacantes autenticados, con acceso de nivel de colaborador y superior, inyecten scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada."}], "id": "CVE-2026-0549", "lastModified": "2026-06-17T10:10:55.903", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-0549", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-19T21:03:49.159926Z", "version": "2.0.3"}}]}, "published": "2026-02-19T07:17:41.300", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/groups/tags/3.9.0/lib/views/class-groups-shortcodes.php?marks=185#L185"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3438974%40groups&new=3438974%40groups&sfp_email=&sfph_mail=#file39"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/75000e67-7914-43af-be1d-82990ada5129?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,3.10.0]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Groups", "source": "cna", "vendor": "itthinx"}, "product": "groups", "vendor": "itthinx"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-15T20:18:16.224246+00:00", "value": {"mitigation_remediation": ["Upgrade the Groups plugin to a version newer than 3.10.0, which includes proper input validation and output escaping for the groups_group_info shortcode.", "If an immediate upgrade is not possible, remove or disable the problematic shortcode by adding a removal rule such as remove_shortcode('groups_group_info') to a custom plugin or the theme\u2019s functions.php file.", "Ensure that contributors and higher-level roles have strict content restrictions, and audit all user inputs that may be exposed via shortcodes to enforce server\u2011side sanitization."], "summary": {"action": "Immediate Patch", "impact": "Stored Cross-Site Scripting"}, "threat_synthesis": {"affected_systems": "Any WordPress installation using the itthinx:Groups plugin version 3.10.0 or earlier. The vulnerability is present in all releases up to and including v3.10.0, and affects users with Contributor or higher privileges on the site.", "description_and_impact": "The Groups WordPress plugin stores user-supplied attributes from the groups_group_info shortcode without proper sanitization or escaping, allowing an authenticated contributor or higher to store malicious scripts. These scripts are served on subsequent page loads and execute in the context of any visitor who views the page, leading to theft of credentials, session hijacking, or defacement. This weakness is classified as CWE\u201179 involving client\u2011side injection.", "risk_and_exploitability": "The vulnerability has a CVSS score of 6.4, indicating medium severity. Exploit probability is very low (EPSS < 1%) and it is not listed in the CISA KEV catalog, suggesting limited public exploitation. Attackers must be authenticated and have at least Contributor access to inject content. Once executed, the stored script runs for any visitor, making the potential impact widespread across all users of the compromised site."}}}}, "created": "2026-02-19T10:07:08.703243+00:00", "updated": "2026-04-15T20:30:13.768358+00:00", "vendors": ["itthinx", "itthinx$PRODUCT$groups", "wordpress", "wordpress$PRODUCT$wordpress"]}