Description
The Groups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'groups_group_info' shortcode in all versions up to, and including, 3.10.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Published: 2026-02-19
Score: 6.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Stored Cross-Site Scripting
Action: Immediate Patch
AI Analysis

Impact

The Groups WordPress plugin stores user-supplied attributes from the groups_group_info shortcode without proper sanitization or escaping, allowing an authenticated contributor or higher to store malicious scripts. These scripts are served on subsequent page loads and execute in the context of any visitor who views the page, leading to theft of credentials, session hijacking, or defacement. This weakness is classified as CWE‑79 involving client‑side injection.

Affected Systems

Any WordPress installation using the itthinx:Groups plugin version 3.10.0 or earlier. The vulnerability is present in all releases up to and including v3.10.0, and affects users with Contributor or higher privileges on the site.

Risk and Exploitability

The vulnerability has a CVSS score of 6.4, indicating medium severity. Exploit probability is very low (EPSS < 1%) and it is not listed in the CISA KEV catalog, suggesting limited public exploitation. Attackers must be authenticated and have at least Contributor access to inject content. Once executed, the stored script runs for any visitor, making the potential impact widespread across all users of the compromised site.

Generated by OpenCVE AI on April 15, 2026 at 20:18 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the Groups plugin to a version newer than 3.10.0, which includes proper input validation and output escaping for the groups_group_info shortcode.
  • If an immediate upgrade is not possible, remove or disable the problematic shortcode by adding a removal rule such as remove_shortcode('groups_group_info') to a custom plugin or the theme’s functions.php file.
  • Ensure that contributors and higher-level roles have strict content restrictions, and audit all user inputs that may be exposed via shortcodes to enforce server‑side sanitization.

Generated by OpenCVE AI on April 15, 2026 at 20:18 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 20 Feb 2026 01:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 19 Feb 2026 10:30:00 +0000

Type Values Removed Values Added
First Time appeared Itthinx
Itthinx groups
Wordpress
Wordpress wordpress
Vendors & Products Itthinx
Itthinx groups
Wordpress
Wordpress wordpress

Thu, 19 Feb 2026 05:00:00 +0000

Type Values Removed Values Added
Description The Groups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'groups_group_info' shortcode in all versions up to, and including, 3.10.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Title Groups <= 3.10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'groups_group_info' Shortcode
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 6.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N'}

Subscriptions

Itthinx Groups
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-04-08T17:01:16.763Z

Reserved: 2026-01-01T17:44:02.588Z

Link: CVE-2026-0549

cve-icon Vulnrichment

Updated: 2026-02-19T21:04:03.176Z

cve-icon NVD

Status : Deferred

Published: 2026-02-19T07:17:41.300

Modified: 2026-04-15T00:35:42.020

Link: CVE-2026-0549

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-15T20:30:13Z

Weaknesses