PT-2026-114773

CVE-2026-18548

Published

2026-10-14

Updated

2026-10-15

Description by

CVSS 3.1

7.2

High

MetricsAV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Groundhogg versions prior to 4.5.15

Description The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress contains a Stored Cross-Site Scripting issue. This occurs due to insufficient input sanitization and output escaping when handling the ref parameter. Unauthenticated attackers can exploit this to inject arbitrary web scripts into pages, which then execute when a user visits the affected page.

Recommendations Update the plugin to version 4.5.15 or later. Avoid using the ref parameter until the update is applied.

Exploitability

Exploit

Fix

Impacts

Researchers

Thevietronin

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers