Nixpkgs Security Tracker

Dismissed

Permalink CVE-2026-0549

6.4 MEDIUM

CVSS version: 3.1
Attack vector (AV):
Attack complexity (AC):
Privileges required (PR):
User interaction (UI):
Scope (S):
Confidentiality impact (C):
Integrity impact (I):
Availability impact (A):

updated 1 month ago by @LeSuisse Activity log

Created automatic suggestion 1 month ago
@LeSuisse removed
31 packages
- fedigroups
- sway-assign-cgroups
- haskellPackages.groups
- haskellPackages.semigroups
- haskellPackages.groups-generic
- haskellPackages.finite-semigroups
- haskellPackages.quickcheck-groups
- haskellPackages.numbered-semigroups
- python312Packages.dependency-groups
- python313Packages.dependency-groups
- python314Packages.dependency-groups
- gnomeExtensions.kolour-groups-windows
- haskellPackages.gogol-groups-settings
- haskellPackages.commutative-semigroups
- haskellPackages.gogol-groups-migration
- haskellPackages.amazonka-resourcegroups
- chickenPackages_5.chickenEggs.posix-groups
- python312Packages.mypy-boto3-resource-groups
- python313Packages.mypy-boto3-resource-groups
- python314Packages.mypy-boto3-resource-groups
- python312Packages.azure-mgmt-managementgroups
- python313Packages.azure-mgmt-managementgroups
- python314Packages.azure-mgmt-managementgroups
- haskellPackages.amazonka-resourcegroupstagging
- python312Packages.types-aiobotocore-resource-groups
- python313Packages.types-aiobotocore-resource-groups
- python312Packages.mypy-boto3-resourcegroupstaggingapi
- python313Packages.mypy-boto3-resourcegroupstaggingapi
- python314Packages.mypy-boto3-resourcegroupstaggingapi
- python312Packages.types-aiobotocore-resourcegroupstaggingapi
- python313Packages.types-aiobotocore-resourcegroupstaggingapi
1 month ago
@LeSuisse dismissed 1 month ago

Groups <= 3.10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'groups_group_info' Shortcode

The Groups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'groups_group_info' shortcode in all versions up to, and including, 3.10.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

References

Affected products

Groups

=<3.10.0

Ignored packages (31)

pkgs.fedigroups

Approximation of groups usable with Fediverse software that implements the Mastodon client API

nixos-unstable 0.4.6
- nixpkgs-unstable 0.4.6
- nixos-unstable-small 0.4.6
nixos-25.11 0.4.6
- nixos-25.11-small 0.4.6
- nixpkgs-25.11-darwin 0.4.6

pkgs.sway-assign-cgroups

Place GUI applications into systemd scopes for systemd-oomd compatibility

nixos-unstable 0.4.1
- nixpkgs-unstable 0.4.1
- nixos-unstable-small 0.4.1
nixos-25.11 0.4.1
- nixos-25.11-small 0.4.1
- nixpkgs-25.11-darwin 0.4.1

pkgs.haskellPackages.groups

Groups

nixos-unstable 0.5.3
- nixpkgs-unstable 0.5.3
- nixos-unstable-small 0.5.3
nixos-25.11 0.5.3
- nixos-25.11-small 0.5.3
- nixpkgs-25.11-darwin 0.5.3

pkgs.haskellPackages.semigroups

Anything that associates

nixos-unstable 0.20
- nixpkgs-unstable 0.20
- nixos-unstable-small 0.20
nixos-25.11 0.20
- nixos-25.11-small 0.20
- nixpkgs-25.11-darwin 0.20

pkgs.haskellPackages.groups-generic

Generically derive Group instances

nixos-unstable 0.3.1.0
- nixpkgs-unstable 0.3.1.0
- nixos-unstable-small 0.3.1.0
nixos-25.11 0.3.1.0
- nixos-25.11-small 0.3.1.0
- nixpkgs-25.11-darwin 0.3.1.0

pkgs.haskellPackages.finite-semigroups

Operations and classification for finite semigroups

nixos-unstable 0.1.0.0
- nixpkgs-unstable 0.1.0.0
- nixos-unstable-small 0.1.0.0
nixos-25.11 0.1.0.0
- nixos-25.11-small 0.1.0.0
- nixpkgs-25.11-darwin 0.1.0.0

pkgs.haskellPackages.quickcheck-groups

Testing group class instances with QuickCheck

nixos-unstable 0.0.1.5
- nixpkgs-unstable 0.0.1.5
- nixos-unstable-small 0.0.1.5
nixos-25.11 0.0.1.5
- nixos-25.11-small 0.0.1.5
- nixpkgs-25.11-darwin 0.0.1.5

pkgs.haskellPackages.numbered-semigroups

A sequence of semigroups, for composing stuff in multiple spatial directions

nixos-unstable 0.1.1.0
- nixpkgs-unstable 0.1.1.0
- nixos-unstable-small 0.1.1.0
nixos-25.11 0.1.1.0
- nixos-25.11-small 0.1.1.0
- nixpkgs-25.11-darwin 0.1.1.0

pkgs.python312Packages.dependency-groups

A standalone implementation of PEP 735 Dependency Groups

nixos-25.11 1.3.1
- nixos-25.11-small 1.3.1
- nixpkgs-25.11-darwin 1.3.1

pkgs.python313Packages.dependency-groups

A standalone implementation of PEP 735 Dependency Groups

nixos-unstable 1.3.1
- nixpkgs-unstable 1.3.1
- nixos-unstable-small 1.3.1
nixos-25.11 1.3.1
- nixos-25.11-small 1.3.1
- nixpkgs-25.11-darwin 1.3.1

pkgs.python314Packages.dependency-groups

A standalone implementation of PEP 735 Dependency Groups

nixos-unstable 1.3.1
- nixpkgs-unstable 1.3.1
- nixos-unstable-small 1.3.1

pkgs.gnomeExtensions.kolour-groups-windows

Window management with color groups and grayscale effects

nixos-unstable 4
- nixpkgs-unstable 4
- nixos-unstable-small 4
nixos-25.11 4
- nixos-25.11-small 4
- nixpkgs-25.11-darwin 4

pkgs.haskellPackages.gogol-groups-settings

Google Groups Settings SDK

nixos-unstable 1.0.0
- nixpkgs-unstable 1.0.0
- nixos-unstable-small 1.0.0
nixos-25.11 1.0.0
- nixos-25.11-small 1.0.0
- nixpkgs-25.11-darwin 1.0.0

pkgs.haskellPackages.commutative-semigroups

Commutative semigroups

nixos-unstable 0.2.0.2
- nixpkgs-unstable 0.2.0.2
- nixos-unstable-small 0.2.0.2
nixos-25.11 0.2.0.2
- nixos-25.11-small 0.2.0.2
- nixpkgs-25.11-darwin 0.2.0.2