← WordPress Vulnerabilities
WordPress security by component

Groundhogg

Groundhogg is a WordPress component with 28 published CVE records in this archive. The latest tracked vulnerability was published Jul 13, 2026; the highest CVE/CNA score is 9.1.

Plugin slug: groundhogg

CVE-2026-57389: Groundhogg: Filesystem traversal

Groundhogg is affected by filesystem traversal. Exposure depends on how the affected operation is made reachable by the site. A crafted path can escape the intended directory and reach files or directories elsewhere on the server. The published affected range is <= 4.4.1.

PublishedJul 13, 2026
Known safe version4.5
Safe version
Jul 13, 2026 CVE-2026-57389
Groundhogg: Filesystem traversal
Groundhogg is affected by filesystem traversal. Exposure depends on how the affected operation is made reachable by the site. A crafted path can escape the intended directory and reach files or directories elsewhere on the server. The published affected range is <= 4.4.1.
4.5
CVE8.6
NVDPending
Jul 02, 2026 CVE-2026-14029
Groundhogg — CRM, Newsletters, and Marketing Automation: SQL injection
Groundhogg — CRM, Newsletters, and Marketing Automation is affected by SQL injection. Exploitation requires an authenticated WordPress account. A successful request can alter database queries and expose or modify WordPress data. The published affected range is <= 4.5.8.
> 4.5.8
CVE6.5
NVDPending
Jun 27, 2026 CVE-2026-13333
Groundhogg — CRM, Newsletters, and Marketing Automation: SQL injection
Groundhogg — CRM, Newsletters, and Marketing Automation is affected by SQL injection. Exploitation requires an authenticated WordPress account. A successful request can alter database queries and expose or modify WordPress data. The published affected range is <= 4.5.5.
> 4.5.5
CVE6.5
NVDPending
Jun 27, 2026 CVE-2026-13331
Groundhogg — CRM, Newsletters, and Marketing Automation: SQL injection
Groundhogg — CRM, Newsletters, and Marketing Automation is affected by SQL injection. Exploitation requires an authenticated WordPress account. A successful request can alter database queries and expose or modify WordPress data. The published affected range is <= 4.5.5.
> 4.5.5
CVE6.5
NVDPending
Jun 26, 2026 CVE-2026-57667
Groundhogg: SQL injection
Groundhogg is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data. The published affected range is n/a through 4.5.
4.5.1
CVE8.5
NVDPending
Jun 26, 2026 CVE-2026-13226
Groundhogg — CRM, Newsletters, and Marketing Automation: SQL injection
Groundhogg — CRM, Newsletters, and Marketing Automation is affected by SQL injection. Exploitation requires an authenticated WordPress account. A successful request can alter database queries and expose or modify WordPress data. The published affected range is <= 4.5.4.
> 4.5.4
CVE6.5
NVDPending
Jun 15, 2026 CVE-2026-40793
Groundhogg: A security weakness
Groundhogg is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is n/a to < 4.4.1.
4.4.1
CVE6.5
NVDPending
Jun 15, 2026 CVE-2026-40727
Groundhogg: Arbitrary file deletion
Groundhogg is affected by arbitrary file deletion. Exposure depends on how the affected operation is made reachable by the site. A successful request can remove files outside the intended scope and may make the site unavailable. The published affected range is n/a through 4.4.
4.4.1
CVE7.7
NVDPending
Oct 31, 2025 CVE-2025-64367
Groundhogg: Cross-site scripting
Groundhogg is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
See mitigation notes
CVE6.5
NVDPending
Aug 20, 2025 CVE-2025-54053
Groundhogg: Code execution
Groundhogg is affected by code execution. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can run attacker-controlled code in the WordPress hosting account.
See mitigation notes
CVE6.6
NVDPending
Jul 16, 2025 CVE-2025-48300
Groundhogg: Dangerous file upload
Groundhogg is affected by dangerous file upload. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can place attacker-controlled executable content on the server and may lead to full site compromise.
See mitigation notes
CVE9.1
NVDPending
May 09, 2025 CVE-2025-4206
WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg: Code execution
WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg is affected by code execution. Exploitation requires at least administrator-level access. Successful exploitation can run attacker-controlled code in the WordPress hosting account.
See mitigation notes
CVE7.2
NVDPending
Apr 01, 2025 CVE-2025-1267
Groundhogg: Cross-site scripting
Groundhogg is affected by cross-site scripting. Exploitation requires at least administrator-level access. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
See mitigation notes
CVE5.5
NVDPending
Jan 14, 2025 CVE-2025-0394
WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg: Dangerous file upload
WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg is affected by dangerous file upload. Exploitation requires at least author-level access. Successful exploitation can place attacker-controlled executable content on the server and may lead to full site compromise.
See mitigation notes
CVE8.8
NVDPending
Jan 07, 2025 CVE-2024-56289
Groundhogg: Cross-site scripting
Groundhogg is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
See mitigation notes
CVE7.1
NVDPending
Jan 02, 2025 CVE-2024-37235
Groundhogg: Cross-site request forgery
Groundhogg is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.
See mitigation notes
CVE4.3
NVD4.3
Jul 22, 2024 CVE-2024-37264
Groundhogg: Cross-site scripting
Groundhogg is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
See mitigation notes
CVE7.1
NVD6.1
Nov 09, 2023 CVE-2023-34178
Groundhogg: Cross-site request forgery
Groundhogg is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.
See mitigation notes
CVE5.4
NVD8.8
Nov 03, 2023 CVE-2023-34179
Groundhogg: SQL injection
Groundhogg is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.
See mitigation notes
CVE7.6
NVD7.2
Oct 31, 2023 CVE-2023-40681
Groundhogg: Cross-site scripting
Groundhogg is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
See mitigation notes
CVE5.9
NVD4.8
May 20, 2023 CVE-2023-2736
Groundhogg: Cross-site request forgery
Groundhogg is affected by cross-site request forgery. Exploitation requires an authenticated WordPress account. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.
See mitigation notes
CVE7.5
NVD8.0
May 20, 2023 CVE-2023-2735
Groundhogg: Cross-site scripting
Groundhogg is affected by cross-site scripting. Exploitation requires an authenticated WordPress account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
See mitigation notes
CVE4.9
NVD5.4
May 20, 2023 CVE-2023-2717
Groundhogg: Cross-site request forgery
Groundhogg is affected by cross-site request forgery. The vulnerable path is reachable without authentication. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.
See mitigation notes
CVE5.4
NVD4.3
May 20, 2023 CVE-2023-2716
Groundhogg: A security weakness
Groundhogg is affected by a security weakness. Exploitation requires at least subscriber-level access. The resulting impact depends on how the affected component exposes the vulnerable operation.
See mitigation notes
CVE5.4
NVD5.4
May 20, 2023 CVE-2023-2715
Groundhogg: A security weakness
Groundhogg is affected by a security weakness. Exploitation requires an authenticated WordPress account. The resulting impact depends on how the affected component exposes the vulnerable operation.
See mitigation notes
CVE4.3
NVD4.3
May 20, 2023 CVE-2023-2714
Groundhogg: A security weakness
Groundhogg is affected by a security weakness. Exploitation requires an authenticated WordPress account. The resulting impact depends on how the affected component exposes the vulnerable operation.
See mitigation notes
CVE4.3
NVD4.3
Apr 10, 2023 CVE-2023-1425
WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg: SQL injection
WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.
See mitigation notes
CVE7.2
NVD7.2
Aug 27, 2019 CVE-2019-15647
Groundhogg: Code execution
Groundhogg is affected by code execution. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can run attacker-controlled code in the WordPress hosting account.
See mitigation notes
CVE8.8
NVD8.8