GR
Vendor
Groundhogg
20
CVEs
0
On KEV
2
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-106603 | HO HollerBox Groundhogg | 6.5 | Oct 8 | WordPress HollerBox plugin <= 2.3.14 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-104408 | GR Groundhogg Groundhogg | 7.6 | Oct 5 | WordPress Groundhogg plugin <= 4.8.3 - SQL Injection vulnerability |
| CVE-2026-48885 | HO HollerBox Groundhogg | 7.1 | Jun 15 | WordPress HollerBox plugin <= 2.3.10.1 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-40793 | GR Groundhogg Groundhogg | 6.5 | Jun 15 | WordPress Groundhogg plugin < 4.4.1 - Broken Access Control vulnerability |
| CVE-2026-40727 | GR Groundhogg Groundhogg | 7.7 | Jun 15 | WordPress Groundhogg plugin <= 4.4 - Arbitrary File Deletion vulnerability |
| CVE-2024-37235 | GR Groundhogg Groundhogg | 4.3 | Jan 2 | WordPress Groundhogg plugin <= 3.4.2.3 - Cross Site Request Forgery (CSRF) vulnerability |
| CVE-2024-37264 | GR Groundhogg Groundhogg | 6.1 | Jul 22 | WordPress Groundhogg plugin <= 3.4.2.3 - Reflected Cross Site Scripting (XSS) vulnerability |
| CVE-2023-34178 | GR Groundhogg Groundhogg | 8.8 | Nov 9 | WordPress Groundhogg Plugin <= 2.7.11 is vulnerable to Cross Site Request Forgery (CSRF) |
| CVE-2023-34179 | GR Groundhogg Groundhogg | 7.2 | Nov 3 | WordPress Groundhogg Plugin <= 2.7.11 is vulnerable to SQL Injection |
| CVE-2023-40681 | GR Groundhogg Groundhogg | 4.8 | Oct 31 | WordPress Groundhogg Plugin <= 2.7.11.10 is vulnerable to Cross Site Scripting (XSS) |
| CVE-2023-41657 | HO Hollerbox Groundhogg | 4.8 | Sep 29 | WordPress HollerBox Plugin <= 2.3.2 is vulnerable to Cross Site Scripting (XSS) |
| CVE-2023-2111 | HO Hollerbox Groundhogg | 4.9 | May 30 | HollerBox < 2.1.4 - Admin+ SQL Injection |
| CVE-2023-2717 | GR Groundhogg Groundhogg | 4.3 | May 20 | Groundhogg <= 2.7.9.8 - Cross-Site Request Forgery to Disable All Plugins |
| CVE-2023-2736 | GR Groundhogg Groundhogg | 8.0 | May 20 | Groundhogg <= 2.7.9.8 - Cross-Site Request Forgery to Privilege Escalation |
| CVE-2023-2735 | GR Groundhogg Groundhogg | 5.4 | May 20 | Groundhogg <= 2.7.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode |
| CVE-2023-2716 | GR Groundhogg Groundhogg | 5.4 | May 20 | Groundhogg <= 2.7.9.8 - Missing Authorization to Non-Arbitrary File Upload |
| CVE-2023-2714 | GR Groundhogg Groundhogg | 4.3 | May 20 | Groundhogg <= 2.7.9.8 - Missing Authorization to Update License |
| CVE-2023-2715 | GR Groundhogg Groundhogg | 4.3 | May 20 | Groundhogg <= 2.7.9.8 - Missing Authorization to Admin Account and Ticket Creation |
| CVE-2023-1425 | GR Groundhogg Groundhogg | 7.2 | Apr 10 | Groundhogg Contacts < 2.7.9.4 - Admin+ SQLi |
| CVE-2019-15647 | GR Groundhogg Groundhogg | 8.8 | Aug 27 | The groundhogg plugin before 1.3.5 for WordPress has wp-admin/admin-ajax.php?action=bulk_action_listener remote code execution |