WordPress security by component

Groundhogg — CRM, Newsletters, and Marketing Automation

Plugin description

Groundhogg — CRM, Newsletters, and Marketing Automation adds customer relationship management, newsletters, funnels, and marketing automation features to WordPress.

Groundhogg — CRM, Newsletters, and Marketing Automation (groundhogg-crm-newsletters-and-marketing-automation) is a WordPress plugin with 3 published CVE records in this archive. The latest tracked vulnerability was published Sep 09, 2026; the highest published CVSS base score is 8.8.

Plugin slug: groundhogg-crm-newsletters-and-marketing-automation

Latest vulnerability

CVE-2026-81741: Groundhogg redirects email-preference confirmations to attacker-selected URLs

Groundhogg before 4.7.2 does not constrain email-preference confirmation redirects to the site's host. An unauthenticated attacker can craft a link that redirects a visitor to an external destination, making the site's trusted address usable as a step in a phishing lure.

PublishedSep 09, 2026

Known safe version4.7.2

Published vulnerabilities for groundhogg-crm-newsletters-and-marketing-automation
		Safe version
Sep 09, 2026	CVE-2026-81741 Groundhogg redirects email-preference confirmations to attacker-selected URLs Groundhogg before 4.7.2 does not constrain email-preference confirmation redirects to the site's host. An unauthenticated attacker can craft a link that redirects a visitor to an external destination, making the site's trusted address usable as a step in a phishing lure.	4.7.2	CVE4.7 NVDPending
Aug 30, 2026	CVE-2026-81660 Groundhogg web forms permit unauthenticated stored XSS against administrators Groundhogg before 4.5.13 does not validate or escape values submitted through some optional web form fields before storing and rendering them in an administrative area. An unauthenticated visitor can submit script content that executes when a high-privilege user views the affected data.	4.5.13	CVE8.8 NVDPending
Nov 21, 2025	CVE-2025-12750 Groundhogg — CRM, Newsletters, and Marketing Automation: SQL injection Groundhogg — CRM, Newsletters, and Marketing Automation is affected by SQL injection. Exploitation requires an authenticated administrator account. A successful request can alter database queries and expose or modify WordPress data.	See mitigation notes	CVE4.9 NVDPending

Data attribution: This product uses the NVD API but is not endorsed or certified by the NVD.

Vulnerability data licensing

CVE. Copyright © 1999–2026, The MITRE Corporation. MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

CWE. Copyright © 2006–2026, The MITRE Corporation. CWE™ is free to use by any organization or individual for any research, development, and/or commercial purposes, per these CWE Terms of Use. Accordingly, The MITRE Corporation hereby grants you a non-exclusive, royalty-free license to use CWE for research, development, and commercial purposes. Any copy you make for such purposes is authorized on the condition that you reproduce MITRE’s copyright designation and this license in any such copy.

CVSS. CVSS is owned and managed by FIRST.Org, Inc. (FIRST) and used by permission.

Source-record text is CVE/CNA content delivered through the NVD API. Fused summaries and remediation guidance are independently authored and are not attributed to NVD.

All other copyrights and trademarks are the property of their respective owners.

Full data sources, terms, and disclaimers