WordPress security by component
Groundhogg
Plugin description
Groundhogg is a WordPress component with 28 published CVE records in this archive. The latest tracked vulnerability was published Jul 13, 2026; the highest CVE/CNA score is 9.1.
Plugin slug:
groundhoggLatest vulnerability
CVE-2026-57389: Groundhogg: Filesystem traversal
Groundhogg is affected by filesystem traversal. Exposure depends on how the affected operation is made reachable by the site. A crafted path can escape the intended directory and reach files or directories elsewhere on the server. The published affected range is <= 4.4.1.
| Safe version |
|
||
|---|---|---|---|
| Jul 13, 2026 |
CVE-2026-57389
Groundhogg: Filesystem traversal
Groundhogg is affected by filesystem traversal. Exposure depends on how the affected operation is made reachable by the site. A crafted path can escape the intended directory and reach files or directories elsewhere on the server. The published affected range is <= 4.4.1.
|
4.5 |
CVE8.6
NVDPending
|
| Jul 02, 2026 |
CVE-2026-14029
Groundhogg — CRM, Newsletters, and Marketing Automation: SQL injection
Groundhogg — CRM, Newsletters, and Marketing Automation is affected by SQL injection. Exploitation requires an authenticated WordPress account. A successful request can alter database queries and expose or modify WordPress data. The published affected range is <= 4.5.8.
|
> 4.5.8 |
CVE6.5
NVDPending
|
| Jun 27, 2026 |
CVE-2026-13333
Groundhogg — CRM, Newsletters, and Marketing Automation: SQL injection
Groundhogg — CRM, Newsletters, and Marketing Automation is affected by SQL injection. Exploitation requires an authenticated WordPress account. A successful request can alter database queries and expose or modify WordPress data. The published affected range is <= 4.5.5.
|
> 4.5.5 |
CVE6.5
NVDPending
|
| Jun 27, 2026 |
CVE-2026-13331
Groundhogg — CRM, Newsletters, and Marketing Automation: SQL injection
Groundhogg — CRM, Newsletters, and Marketing Automation is affected by SQL injection. Exploitation requires an authenticated WordPress account. A successful request can alter database queries and expose or modify WordPress data. The published affected range is <= 4.5.5.
|
> 4.5.5 |
CVE6.5
NVDPending
|
| Jun 26, 2026 |
CVE-2026-57667
Groundhogg: SQL injection
Groundhogg is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data. The published affected range is n/a through 4.5.
|
4.5.1 |
CVE8.5
NVDPending
|
| Jun 26, 2026 |
CVE-2026-13226
Groundhogg — CRM, Newsletters, and Marketing Automation: SQL injection
Groundhogg — CRM, Newsletters, and Marketing Automation is affected by SQL injection. Exploitation requires an authenticated WordPress account. A successful request can alter database queries and expose or modify WordPress data. The published affected range is <= 4.5.4.
|
> 4.5.4 |
CVE6.5
NVDPending
|
| Jun 15, 2026 |
CVE-2026-40793
Groundhogg: A security weakness
Groundhogg is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is n/a to < 4.4.1.
|
4.4.1 |
CVE6.5
NVDPending
|
| Jun 15, 2026 |
CVE-2026-40727
Groundhogg: Arbitrary file deletion
Groundhogg is affected by arbitrary file deletion. Exposure depends on how the affected operation is made reachable by the site. A successful request can remove files outside the intended scope and may make the site unavailable. The published affected range is n/a through 4.4.
|
4.4.1 |
CVE7.7
NVDPending
|
| Oct 31, 2025 |
CVE-2025-64367
Groundhogg: Cross-site scripting
Groundhogg is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.5
NVDPending
|
| Aug 20, 2025 |
CVE-2025-54053
Groundhogg: Code execution
Groundhogg is affected by code execution. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can run attacker-controlled code in the WordPress hosting account.
|
See mitigation notes |
CVE6.6
NVDPending
|
| Jul 16, 2025 |
CVE-2025-48300
Groundhogg: Dangerous file upload
Groundhogg is affected by dangerous file upload. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can place attacker-controlled executable content on the server and may lead to full site compromise.
|
See mitigation notes |
CVE9.1
NVDPending
|
| May 09, 2025 |
CVE-2025-4206
WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg: Code execution
WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg is affected by code execution. Exploitation requires at least administrator-level access. Successful exploitation can run attacker-controlled code in the WordPress hosting account.
|
See mitigation notes |
CVE7.2
NVDPending
|
| Apr 01, 2025 |
CVE-2025-1267
Groundhogg: Cross-site scripting
Groundhogg is affected by cross-site scripting. Exploitation requires at least administrator-level access. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE5.5
NVDPending
|
| Jan 14, 2025 |
CVE-2025-0394
WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg: Dangerous file upload
WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg is affected by dangerous file upload. Exploitation requires at least author-level access. Successful exploitation can place attacker-controlled executable content on the server and may lead to full site compromise.
|
See mitigation notes |
CVE8.8
NVDPending
|
| Jan 07, 2025 |
CVE-2024-56289
Groundhogg: Cross-site scripting
Groundhogg is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE7.1
NVDPending
|
| Jan 02, 2025 |
CVE-2024-37235
Groundhogg: Cross-site request forgery
Groundhogg is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.
|
See mitigation notes |
CVE4.3
NVD4.3
|
| Jul 22, 2024 |
CVE-2024-37264
Groundhogg: Cross-site scripting
Groundhogg is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE7.1
NVD6.1
|
| Nov 09, 2023 |
CVE-2023-34178
Groundhogg: Cross-site request forgery
Groundhogg is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.
|
See mitigation notes |
CVE5.4
NVD8.8
|
| Nov 03, 2023 |
CVE-2023-34179
Groundhogg: SQL injection
Groundhogg is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.
|
See mitigation notes |
CVE7.6
NVD7.2
|
| Oct 31, 2023 |
CVE-2023-40681
Groundhogg: Cross-site scripting
Groundhogg is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE5.9
NVD4.8
|
| May 20, 2023 |
CVE-2023-2736
Groundhogg: Cross-site request forgery
Groundhogg is affected by cross-site request forgery. Exploitation requires an authenticated WordPress account. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.
|
See mitigation notes |
CVE7.5
NVD8.0
|
| May 20, 2023 |
CVE-2023-2735
Groundhogg: Cross-site scripting
Groundhogg is affected by cross-site scripting. Exploitation requires an authenticated WordPress account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE4.9
NVD5.4
|
| May 20, 2023 |
CVE-2023-2717
Groundhogg: Cross-site request forgery
Groundhogg is affected by cross-site request forgery. The vulnerable path is reachable without authentication. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.
|
See mitigation notes |
CVE5.4
NVD4.3
|
| May 20, 2023 |
CVE-2023-2716
Groundhogg: A security weakness
Groundhogg is affected by a security weakness. Exploitation requires at least subscriber-level access. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE5.4
NVD5.4
|
| May 20, 2023 |
CVE-2023-2715
Groundhogg: A security weakness
Groundhogg is affected by a security weakness. Exploitation requires an authenticated WordPress account. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE4.3
NVD4.3
|
| May 20, 2023 |
CVE-2023-2714
Groundhogg: A security weakness
Groundhogg is affected by a security weakness. Exploitation requires an authenticated WordPress account. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE4.3
NVD4.3
|
| Apr 10, 2023 |
CVE-2023-1425
WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg: SQL injection
WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.
|
See mitigation notes |
CVE7.2
NVD7.2
|
| Aug 27, 2019 |
CVE-2019-15647
Groundhogg: Code execution
Groundhogg is affected by code execution. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can run attacker-controlled code in the WordPress hosting account.
|
See mitigation notes |
CVE8.8
NVD8.8
|