Stored Cross-Site Scripting in Groundhogg CRM Plugin for WordPress
CVE-2026-18548

7.2HIGH

Key Information:

Vendor

WordPress
Status
Groundhogg — Crm, Newsletters, And Marketing Automation
Vendor
CVE Published:
15 October 2026

What is CVE-2026-18548?

The Groundhogg CRM, Newsletters, and Marketing Automation plugin for WordPress exposes users to a Stored Cross-Site Scripting vulnerability through the 'ref' parameter in all versions up to 4.5.14. Due to inadequate input sanitization and output escaping, unauthenticated attackers can exploit this weakness to inject malicious web scripts into pages. These scripts can execute automatically whenever a user accesses a compromised page, posing significant security risks to both the website and its users.

Affected Version(s)

Groundhogg — CRM, Newsletters, and Marketing Automation 0 <= 4.5.14

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://github.com/groundhoggwp/groundhogg/commit/8a6fe60...
https://plugins.trac.wordpress.org/browser/groundhogg/tag...

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

thevietronin
.