Skip to contentTrainingbusinesspros Groundhogg — Crm, Newsletters, And Marketing Automation vulnerabilities
- trainingbusinesspros groundhogg — crm, newsletters, and marketing automationGroundhogg <= 4.9.3 - Authenticated (Sales Representative+) Arbitrary File Deletion via CSV Import 'copy_file' Field MappingCVE-2026-1092218.1 High
- trainingbusinesspros groundhogg — crm, newsletters, and marketing automationGroundhogg <= 4.5.14 - Unauthenticated Stored Cross-Site Scripting via 'ref' ParameterCVE-2026-185487.2 High
- trainingbusinesspros groundhogg — crm, newsletters, and marketing automationGroundhogg <= 4.8.3 - Unauthenticated Privilege Escalation to Support User Identity ConfusionCVE-2026-929758.1 High
- trainingbusinesspros groundhogg — crm, newsletters, and marketing automationGroundhogg <= 4.9 - Authenticated (Custom+) Privilege Escalation to 'user' ParameterCVE-2026-1047258.8 High
- trainingbusinesspros groundhogg — crm, newsletters, and marketing automationGroundhogg <= 4.9 - Authenticated (Sales Person+) Privilege Escalation via Contact Identity Rebinding leading to Administrator Account Takeover to 'user_id' Parameter (v3 /contacts) chained with v4 /e…CVE-2026-976448.8 High
- trainingbusinesspros groundhogg — crm, newsletters, and marketing automationGroundhogg < 4.7.2 - Open Redirect via 'redirect_to' ParameterCVE-2026-817414.7 Medium
- trainingbusinesspros groundhogg — crm, newsletters, and marketing automationGroundhogg < 4.5.13 - Unauthenticated Stored XSS via Web Form Dropdown/Radio FieldCVE-2026-816608.8 High
- trainingbusinesspros groundhogg — crm, newsletters, and marketing automationGroundhogg <= 4.5.14 - Authenticated (Vendor+) SQL Injection via 'tag_query' ParameterCVE-2026-183876.5 Medium
- trainingbusinesspros groundhogg — crm, newsletters, and marketing automationGroundhogg — CRM, Newsletters, and Marketing Automation <= 4.5.2 - Insecure Direct Object ReferenceCVE-2026-114546.5 Medium
- trainingbusinesspros groundhogg — crm, newsletters, and marketing automationGroundhogg <= 4.5.8 - Authenticated (Custom+) SQL Injection via 'select' ParameterCVE-2026-140296.5 Medium
- trainingbusinesspros groundhogg — crm, newsletters, and marketing automationGroundhogg <= 4.5.5 - Authenticated (Sales Rep+) SQL Injection via 'query[select]' ParameterCVE-2026-133336.5 Medium
- trainingbusinesspros groundhogg — crm, newsletters, and marketing automationGroundhogg <= 4.5.5 - Authenticated (Marketer+) SQL Injection via 'search' ParameterCVE-2026-133316.5 Medium
- trainingbusinesspros groundhogg — crm, newsletters, and marketing automationGroundhogg <= 4.5.4 - Authenticated (Custom+) SQL Injection via 'after' ParameterCVE-2026-132266.5 Medium
- trainingbusinesspros groundhogg — crm, newsletters, and marketing automationGroundhogg <= 4.2.6.1 - Authenticated (Admin+) SQL InjectionCVE-2025-127504.9 Medium
- trainingbusinesspros groundhogg — crm, newsletters, and marketing automationWordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg <= 4.1.1.2 - Authenticated (Administrator+) Arbitrary File DeletionCVE-2025-42067.2 High
- trainingbusinesspros groundhogg — crm, newsletters, and marketing automationGroundhogg <= 3.7.4.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via label ParameterCVE-2025-12675.5 Medium
- trainingbusinesspros groundhogg — crm, newsletters, and marketing automationGroundhogg <= 3.7.3.5 - Authenticated (Author+) Arbitrary File Upload via gh_big_file_upload FunctionCVE-2025-03948.8 High
- groundhogg, trainingbusinesspros groundhogg — crm, newsletters, and marketing automation +1 moreGroundhogg <= 2.7.9.8 - Cross-Site Request Forgery to Disable All PluginsCVE-2023-27175.4 Medium
- groundhogg, trainingbusinesspros groundhogg — crm, newsletters, and marketing automation +1 moreGroundhogg <= 2.7.9.8 - Cross-Site Request Forgery to Privilege EscalationCVE-2023-27367.5 High
- groundhogg, trainingbusinesspros groundhogg — crm, newsletters, and marketing automation +1 moreGroundhogg <= 2.7.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeCVE-2023-27354.9 Medium
- groundhogg, trainingbusinesspros groundhogg — crm, newsletters, and marketing automation +1 moreGroundhogg <= 2.7.9.8 - Missing Authorization to Non-Arbitrary File UploadCVE-2023-27165.4 Medium
- groundhogg, trainingbusinesspros groundhogg — crm, newsletters, and marketing automation +1 moreGroundhogg <= 2.7.9.8 - Missing Authorization to Update LicenseCVE-2023-27144.3 Medium
- groundhogg, trainingbusinesspros groundhogg — crm, newsletters, and marketing automation +1 moreGroundhogg <= 2.7.9.8 - Missing Authorization to Admin Account and Ticket CreationCVE-2023-27154.3 Medium