GC
Product
Groundhogg — CRM, Newsletters, and Marketing Automation
21
CVEs
0
On KEV
8.8
Max CVSS
5
New 30D
Severity mix
Critical 0High 8Medium 13Low 0
Watch
Add Groundhogg — CRM, Newsletters, and Marketing Automation to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-18387 | 6.5 | Aug 15 | Groundhogg <= 4.5.14 - Authenticated (Vendor+) SQL Injection via 'tag_query' Parameter Affected: through 4.5.14 |
| CVE-2026-11454 | 6.5 | Aug 5 | Groundhogg — CRM, Newsletters, and Marketing Automation <= 4.5.2 - Insecure Direct Object Reference Affected: through 4.5.2 |
| CVE-2026-14029 | 6.5 | Jul 2 | Groundhogg <= 4.5.8 - Authenticated (Custom+) SQL Injection via 'select' Parameter Affected: through 4.5.8 |
| CVE-2026-13333 | 6.5 | Jun 27 | Groundhogg <= 4.5.5 - Authenticated (Sales Rep+) SQL Injection via 'query[select]' Parameter Affected: through 4.5.5 |
| CVE-2026-13331 | 6.5 | Jun 27 | Groundhogg <= 4.5.5 - Authenticated (Marketer+) SQL Injection via 'search' Parameter Affected: through 4.5.5 |
| CVE-2026-13226 | 6.5 | Jun 26 | Groundhogg <= 4.5.4 - Authenticated (Custom+) SQL Injection via 'after' Parameter Affected: through 4.5.4 |
| CVE-2025-1267 | 5.5 | Apr 1 | Groundhogg <= 3.7.4.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via label Parameter Affected: through 3.7.4.1 |
| CVE-2023-2735 | 5.4 | May 20 | Groundhogg <= 2.7.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Affected: through 2.7.9.8 |
| CVE-2023-2716 | 5.4 | May 20 | Groundhogg <= 2.7.9.8 - Missing Authorization to Non-Arbitrary File Upload Affected: through 2.7.9.8 |
| CVE-2025-12750 | 4.9 | Nov 21 | Groundhogg <= 4.2.6.1 - Authenticated (Admin+) SQL Injection Affected: through 4.2.6.1 |
| CVE-2023-2717 | 4.3 | May 20 | Groundhogg <= 2.7.9.8 - Cross-Site Request Forgery to Disable All Plugins Affected: through 2.7.9.8 |
| CVE-2023-2714 | 4.3 | May 20 | Groundhogg <= 2.7.9.8 - Missing Authorization to Update License Affected: through 2.7.9.8 |
| CVE-2023-2715 | 4.3 | May 20 | Groundhogg <= 2.7.9.8 - Missing Authorization to Admin Account and Ticket Creation Affected: through 2.7.8.9 |
Showing 13