Skip to content

Trainingbusinesspros vulnerabilities

Products

Newest

trainingbusinesspros groundhogg — crm, newsletters, and marketing automation Groundhogg <= 4.9.3 - Authenticated (Sales Representative+) Arbitrary File Deletion via CSV Import 'copy_file' Field Mapping CVE-2026-109221 8.1 HighOctober 16, 2026
trainingbusinesspros groundhogg — crm, newsletters, and marketing automation Groundhogg <= 4.5.14 - Unauthenticated Stored Cross-Site Scripting via 'ref' Parameter CVE-2026-18548 7.2 HighOctober 15, 2026
trainingbusinesspros groundhogg — crm, newsletters, and marketing automation Groundhogg <= 4.8.3 - Unauthenticated Privilege Escalation to Support User Identity Confusion CVE-2026-92975 8.1 HighOctober 10, 2026
trainingbusinesspros groundhogg — crm, newsletters, and marketing automation Groundhogg <= 4.9 - Authenticated (Custom+) Privilege Escalation to 'user' Parameter CVE-2026-104725 8.8 HighOctober 10, 2026
trainingbusinesspros groundhogg — crm, newsletters, and marketing automation Groundhogg <= 4.9 - Authenticated (Sales Person+) Privilege Escalation via Contact Identity Rebinding leading to Administrator Account Takeover to 'user_id' Parameter (v3 /contacts) chained with v4 /e… CVE-2026-97644 8.8 HighOctober 3, 2026
trainingbusinesspros groundhogg — crm, newsletters, and marketing automation Groundhogg < 4.7.2 - Open Redirect via 'redirect_to' Parameter CVE-2026-81741 4.7 MediumSeptember 9, 2026
trainingbusinesspros groundhogg — crm, newsletters, and marketing automation Groundhogg < 4.5.13 - Unauthenticated Stored XSS via Web Form Dropdown/Radio Field CVE-2026-81660 8.8 HighAugust 30, 2026
trainingbusinesspros groundhogg — crm, newsletters, and marketing automation Groundhogg <= 4.5.14 - Authenticated (Vendor+) SQL Injection via 'tag_query' Parameter CVE-2026-18387 6.5 MediumAugust 15, 2026
trainingbusinesspros groundhogg — crm, newsletters, and marketing automation Groundhogg — CRM, Newsletters, and Marketing Automation <= 4.5.2 - Insecure Direct Object Reference CVE-2026-11454 6.5 MediumAugust 5, 2026
trainingbusinesspros groundhogg — crm, newsletters, and marketing automation Groundhogg <= 4.5.8 - Authenticated (Custom+) SQL Injection via 'select' Parameter CVE-2026-14029 6.5 MediumJuly 2, 2026
trainingbusinesspros groundhogg — crm, newsletters, and marketing automation Groundhogg <= 4.5.5 - Authenticated (Sales Rep+) SQL Injection via 'query[select]' Parameter CVE-2026-13333 6.5 MediumJune 27, 2026
trainingbusinesspros groundhogg — crm, newsletters, and marketing automation Groundhogg <= 4.5.5 - Authenticated (Marketer+) SQL Injection via 'search' Parameter CVE-2026-13331 6.5 MediumJune 27, 2026
trainingbusinesspros groundhogg — crm, newsletters, and marketing automation Groundhogg <= 4.5.4 - Authenticated (Custom+) SQL Injection via 'after' Parameter CVE-2026-13226 6.5 MediumJune 26, 2026
trainingbusinesspros formlift for infusionsoft web forms FormLift for Infusionsoft Web Forms <= 7.5.21 - Missing Authorization to Unauthenticated Infusionsoft Connection Hijack via OAuth Connection Flow CVE-2026-4281 5.3 MediumMarch 26, 2026
trainingbusinesspros groundhogg — crm, newsletters, and marketing automation Groundhogg <= 4.2.6.1 - Authenticated (Admin+) SQL Injection CVE-2025-12750 4.9 MediumNovember 21, 2025
adrian tobey formlift for infusionsoft web forms WordPress FormLift for Infusionsoft Web Forms plugin <= 7.5.20 - Reflected Cross Site Scripting (XSS) vulnerability CVE-2025-47654 7.1 HighJune 27, 2025
trainingbusinesspros groundhogg — crm, newsletters, and marketing automation WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg <= 4.1.1.2 - Authenticated (Administrator+) Arbitrary File Deletion CVE-2025-4206 7.2 HighMay 9, 2025
trainingbusinesspros groundhogg — crm, newsletters, and marketing automation Groundhogg <= 3.7.4.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via label Parameter CVE-2025-1267 5.5 MediumApril 1, 2025
adrian tobey formlift for infusionsoft web forms WordPress FormLift for Infusionsoft Web Forms plugin <= 7.5.19 - Cross Site Scripting (XSS) Vulnerability CVE-2025-31434 6.5 MediumMarch 28, 2025
trainingbusinesspros groundhogg — crm, newsletters, and marketing automation Groundhogg <= 3.7.3.5 - Authenticated (Author+) Arbitrary File Upload via gh_big_file_upload Function CVE-2025-0394 8.8 HighJanuary 14, 2025
adrian tobey formlift for infusionsoft web forms, formlift for infusionsoft web forms +1 more WordPress formlift plugin <= 7.5.17 - Unauthenticated Blind SQL Injection vulnerability CVE-2024-38773 9.3 CriticalJuly 22, 2024
groundhogg, trainingbusinesspros groundhogg — crm, newsletters, and marketing automation +1 more Groundhogg <= 2.7.9.8 - Cross-Site Request Forgery to Disable All Plugins CVE-2023-2717 5.4 MediumMay 20, 2023
groundhogg, trainingbusinesspros groundhogg — crm, newsletters, and marketing automation +1 more Groundhogg <= 2.7.9.8 - Cross-Site Request Forgery to Privilege Escalation CVE-2023-2736 7.5 HighMay 20, 2023
groundhogg, trainingbusinesspros groundhogg — crm, newsletters, and marketing automation +1 more Groundhogg <= 2.7.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode CVE-2023-2735 4.9 MediumMay 20, 2023
groundhogg, trainingbusinesspros groundhogg — crm, newsletters, and marketing automation +1 more Groundhogg <= 2.7.9.8 - Missing Authorization to Non-Arbitrary File Upload CVE-2023-2716 5.4 MediumMay 20, 2023
groundhogg, trainingbusinesspros groundhogg — crm, newsletters, and marketing automation +1 more Groundhogg <= 2.7.9.8 - Missing Authorization to Update License CVE-2023-2714 4.3 MediumMay 20, 2023
groundhogg, trainingbusinesspros groundhogg — crm, newsletters, and marketing automation +1 more Groundhogg <= 2.7.9.8 - Missing Authorization to Admin Account and Ticket Creation CVE-2023-2715 4.3 MediumMay 20, 2023
groundhogg, trainingbusinesspros wordpress crm, email & marketing automation for wordpress | award winner — groundhogg +1 more Groundhogg Contacts < 2.7.9.4 - Admin+ SQLi CVE-2023-1425 7.2 HighApril 10, 2023