Executive brief
The Groundhogg WordPress plugin is a customer relationship management and marketing automation tool used by businesses to manage contacts, newsletters, and campaigns. An unauthenticated attacker can inject malicious scripts into web form fields that are stored in the plugin's database and executed when administrators view the data, potentially allowing the attacker to compromise admin accounts and access sensitive customer information.
Technical details
The Groundhogg plugin before version 4.5.13 suffers from a stored cross-site scripting (XSS) vulnerability in its web form functionality. The vulnerability exists because the plugin fails to properly validate and escape user-supplied data submitted to certain optional web form fields (specifically dropdown and radio fields) before storing and re-displaying the data in the WordPress administrative area. An unauthenticated attacker can submit malicious JavaScript code through these form fields; when an administrator later views the submitted form data in the admin dashboard, the unescaped script executes in their browser session. This allows attackers to steal admin credentials, session tokens, or perform unauthorized actions. The issue was patched in version 4.5.13.
Affected products
- Groundhogg Groundhogg — CRM, Newsletters, and Marketing Automation before 4.5.13
Timeline
- 2026-08-28: disclosed
- 2026-08-30: patched: Fixed in version 4.5.13