Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Groundhogg — CRM, Newsletters, and Marketing Automation — Vulnerabilities & Security Advisories 21

All 21 CVE vulnerabilities found in Groundhogg — CRM, Newsletters, and Marketing Automation, with AI-generated Chinese analysis, references, and POCs.

This page aggregates security vulnerabilities associated with Groundhogg, a WordPress plugin providing CRM, newsletter, and marketing automation capabilities. The collection encompasses various weakness types, including cross-site scripting, SQL injection, unauthorized access, and improper input validation, covering disclosures from the plugin’s initial release through recent updates. Readers can utilize this index to track vendor advisories, understand specific weakness classes within the application’s codebase, or review the complete vulnerability history of this marketing tool. The data is organized to facilitate technical analysis and risk assessment for organizations relying on Groundhogg for customer relationship management. By consolidating these records, the page serves as a reference point for security professionals monitoring third-party plugin risks in WordPress environments. It highlights recurring patterns in the software’s development lifecycle, allowing users to identify whether specific issues have been resolved or if new variants emerge. This aggregation supports informed decision-making regarding patching priorities and security posture evaluation for digital marketing infrastructure. The entries reflect official vendor responses, third-party reports, and public exploit disclosures, providing a comprehensive view of the product’s security evolution over time.

Vendor: trainingbusinesspros

CVE ID Title CVSS Severity Published
CVE-2026-92975 Groundhogg <= 4.8.3 - Unauthenticated Privilege Escalation to Support User Identity Confusion CWE-269 8.1 High 2026-10-10
CVE-2026-104725 Groundhogg <= 4.9 - Authenticated (Custom+) Privilege Escalation to 'user' Parameter CWE-269 8.8 High 2026-10-10
CVE-2026-97644 Groundhogg <= 4.9 - Authenticated (Sales Person+) Privilege Escalation via Contact Identity Rebinding leading to Administrator Account Takeover to 'user_id' Parameter (v3 /contacts) chained with v4 /emails/test CWE-269 8.8 High 2026-10-03
CVE-2026-81741 Groundhogg < 4.7.2 - Open Redirect via 'redirect_to' Parameter - - 2026-09-09
CVE-2026-81660 Groundhogg < 4.5.13 - Unauthenticated Stored XSS via Web Form Dropdown/Radio Field - - 2026-08-30
CVE-2026-18387 Groundhogg <= 4.5.14 - Authenticated (Vendor+) SQL Injection via 'tag_query' Parameter CWE-89 6.5 Medium 2026-08-15
CVE-2026-11454 Groundhogg — CRM, Newsletters, and Marketing Automation <= 4.5.2 - Insecure Direct Object Reference CWE-639 6.5 Medium 2026-08-05
CVE-2026-14029 Groundhogg <= 4.5.8 - Authenticated (Custom+) SQL Injection via 'select' Parameter CWE-89 6.5 Medium 2026-07-02
CVE-2026-13333 Groundhogg <= 4.5.5 - Authenticated (Sales Rep+) SQL Injection via 'query[select]' Parameter CWE-89 6.5 Medium 2026-06-27
CVE-2026-13331 Groundhogg <= 4.5.5 - Authenticated (Marketer+) SQL Injection via 'search' Parameter CWE-89 6.5 Medium 2026-06-27
CVE-2026-13226 Groundhogg <= 4.5.4 - Authenticated (Custom+) SQL Injection via 'after' Parameter CWE-89 6.5 Medium 2026-06-26
CVE-2025-12750 Groundhogg <= 4.2.6.1 - Authenticated (Admin+) SQL Injection CWE-89 4.9 Medium 2025-11-21
CVE-2025-4206 WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg <= 4.1.1.2 - Authenticated (Administrator+) Arbitrary File Deletion CWE-22 7.2 High 2025-05-09
CVE-2025-1267 Groundhogg <= 3.7.4.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via label Parameter CWE-79 5.5 Medium 2025-04-01
CVE-2025-0394 Groundhogg <= 3.7.3.5 - Authenticated (Author+) Arbitrary File Upload via gh_big_file_upload Function CWE-434 8.8 High 2025-01-14
CVE-2023-2717 Groundhogg <= 2.7.9.8 - Cross-Site Request Forgery to Disable All Plugins CWE-352 5.4 Medium 2023-05-20
CVE-2023-2736 Groundhogg <= 2.7.9.8 - Cross-Site Request Forgery to Privilege Escalation CWE-352 7.5 High 2023-05-20
CVE-2023-2735 Groundhogg <= 2.7.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode CWE-79 4.9 Medium 2023-05-20
CVE-2023-2716 Groundhogg <= 2.7.9.8 - Missing Authorization to Non-Arbitrary File Upload CWE-862 5.4 Medium 2023-05-20
CVE-2023-2714 Groundhogg <= 2.7.9.8 - Missing Authorization to Update License CWE-862 4.3 Medium 2023-05-20
CVE-2023-2715 Groundhogg <= 2.7.9.8 - Missing Authorization to Admin Account and Ticket Creation CWE-862 4.3 Medium 2023-05-20

All 21 known CVE vulnerabilities affecting Groundhogg — CRM, Newsletters, and Marketing Automation with full Chinese analysis, references, and POCs where available.