CVE-2026-0549
Awaiting Analysis Awaiting Analysis - Queue

Stored XSS in WordPress Groups Plugin Allows Script Injection

Publication date: 2026-02-19

Last updated on: 2026-02-19

Assigner: Wordfence

Description
The Groups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'groups_group_info' shortcode in all versions up to, and including, 3.10.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-02-19
Last Modified
2026-02-19
Generated
2026-07-26
AI Q&A
2026-02-19
EPSS Evaluated
2026-07-25
NVD
CVE-2026-0549
EUVD
EUVD-2026-8223

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
itthinx groups to 3.10.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The vulnerability exists in the Groups plugin for WordPress, specifically in the 'groups_group_info' shortcode. It is a Stored Cross-Site Scripting (XSS) vulnerability caused by insufficient input sanitization and output escaping on user-supplied attributes.

This flaw allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These scripts will execute whenever any user accesses the injected page.

Detection Guidance

I don't know

Impact Analysis

This vulnerability can lead to the execution of malicious scripts in the context of the affected website. An attacker with contributor-level access can inject scripts that run when other users visit the compromised pages.

  • It can result in theft of user credentials or session tokens.
  • It can enable unauthorized actions on behalf of users.
  • It can lead to defacement or manipulation of website content.
Compliance Impact

I don't know

Mitigation Strategies

I don't know

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-0549. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart