GC
Product
Groundhogg — CRM, Newsletters, and Marketing Automation
21
CVEs
0
On KEV
8.8
Max CVSS
5
New 30D
Severity mix
Critical 0High 8Medium 13Low 0
Watch
Add Groundhogg — CRM, Newsletters, and Marketing Automation to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-104725 | 8.8 | Oct 10 | Groundhogg <= 4.9 - Authenticated (Custom+) Privilege Escalation to 'user' Parameter Affected: through 4.9 |
| CVE-2026-97644 | 8.8 | Oct 3 | Groundhogg <= 4.9 - Authenticated (Sales Person+) Privilege Escalation via Contact Identity Rebinding leading to Administrator Account Takeover to 'user_id' Parameter (v3 /contacts) chained with v4 /emails/test Affected: through 4.9 |
| CVE-2025-0394 | 8.8 | Jan 14 | Groundhogg <= 3.7.3.5 - Authenticated (Author+) Arbitrary File Upload via gh_big_file_upload Function Affected: through 3.7.3.5 |
| CVE-2026-109221 | 8.1 | Oct 16 | Groundhogg <= 4.9.3 - Authenticated (Sales Representative+) Arbitrary File Deletion via CSV Import 'copy_file' Field Mapping Affected: through 4.9.3 |
| CVE-2026-92975 | 8.1 | Oct 10 | Groundhogg <= 4.8.3 - Unauthenticated Privilege Escalation to Support User Identity Confusion Affected: through 4.8.3 |
| CVE-2023-2736 | 8.0 | May 20 | Groundhogg <= 2.7.9.8 - Cross-Site Request Forgery to Privilege Escalation Affected: through 2.7.9.8 |
| CVE-2026-18548 | 7.2 | Oct 15 | Groundhogg <= 4.5.14 - Unauthenticated Stored Cross-Site Scripting via 'ref' Parameter Affected: through 4.5.14 |
| CVE-2025-4206 | 7.2 | May 9 | WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg <= 4.1.1.2 - Authenticated (Administrator+) Arbitrary File Deletion Affected: through 4.1.1.2 |
Showing 8