Vulnerabilities

TI-2024-24750 CVE-2024-37235 · GHSA-5xf4-4w8r-m546

WordPress Groundhogg plugin <= 3.4.2.3 - Cross Site Request Forgery (CSRF) vulnerability

LOW 19

Cross-Site Request Forgery (CSRF) vulnerability in Adrian Tobey Groundhogg groundhogg allows Cross Site Request Forgery.This issue affects Groundhogg: from n/a through <= 3.4.2.3.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00188 Published 2025-01-02 No fix listed CWE-352

TI-2024-24779 CVE-2024-37264 · GHSA-wqfv-vr37-w73v

WordPress Groundhogg plugin <= 3.4.2.3 - Reflected Cross Site Scripting (XSS) vulnerability

LOW 31

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Groundhogg Inc.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00308 Published 2024-07-22 No fix listed CWE-79

TI-2023-17022 CVE-2023-34178 · GHSA-hv84-49c9-rmm6

WordPress Groundhogg Plugin <= 2.7.11 is vulnerable to Cross Site Request Forgery (CSRF)

MEDIUM 40

Cross-Site Request Forgery (CSRF) vulnerability in Groundhogg Inc.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00303 Published 2023-11-09 No fix listed CWE-352

TI-2023-17023 CVE-2023-34179 · GHSA-p46v-v2vj-2qfg

WordPress Groundhogg Plugin <= 2.7.11 is vulnerable to SQL Injection

LOW 36

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Groundhogg Inc.

CVSS 3.1HIGH 7.6 Network High privileges No interaction EPSS 0.00681 Published 2023-11-03 No fix listed CWE-89

TI-2023-21473 CVE-2023-40681 · GHSA-xfrq-44jr-w2f3

WordPress Groundhogg Plugin <= 2.7.11.10 is vulnerable to Cross Site Scripting (XSS)

LOW 27

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Groundhogg Inc.

CVSS 3.1MEDIUM 5.9 Network High privileges User interaction EPSS 0.00369 Published 2023-10-31 No fix listed CWE-79

TI-2023-02545 CVE-2023-2717 · GHSA-m9rg-g68w-jqgv

Groundhogg <= 2.7.9.8 - Cross-Site Request Forgery to Disable All Plugins

LOW 24

The Groundhogg plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.7.9.8.

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.00303 Published 2023-05-20 No fix listed CWE-352

TI-2023-02563 CVE-2023-2736 · GHSA-rj8g-vvxw-439q

Groundhogg <= 2.7.9.8 - Cross-Site Request Forgery to Privilege Escalation

LOW 37

The Groundhogg plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.7.9.8.

CVSS 3.1HIGH 8.0 Network Low privileges User interaction EPSS 0.00396 Published 2023-05-20 No fix listed CWE-352

TI-2023-02562 CVE-2023-2735 · GHSA-mmxw-6pg3-mfj3

Groundhogg <= 2.7.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

LOW 25

The Groundhogg plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gh_form' shortcode in versions up to, and including, 2.7.9.8 due to insufficient input sanitization and output escaping on user su…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00494 Published 2023-05-20 No fix listed CWE-79

TI-2023-02544 CVE-2023-2716 · GHSA-q4h6-r5wm-rv47

Groundhogg <= 2.7.9.8 - Missing Authorization to Non-Arbitrary File Upload

LOW 25

The Groundhogg plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on the 'ajax_upload_file' function in versions up to, and including, 2.7.9.8.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00467 Published 2023-05-20 No fix listed CWE-862

TI-2023-02542 CVE-2023-2714 · GHSA-993j-5qpw-jw3c

Groundhogg <= 2.7.9.8 - Missing Authorization to Update License

LOW 21

The Groundhogg plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'check_license' functions in versions up to, and including, 2.7.9.8.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00528 Published 2023-05-20 No fix listed CWE-862

TI-2023-02543 CVE-2023-2715 · GHSA-qx5q-xjh7-6gvc

Groundhogg <= 2.7.9.8 - Missing Authorization to Admin Account and Ticket Creation

LOW 21

The Groundhogg plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'submit_ticket' function in versions up to, and including, 2.7.9.8.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00561 Published 2023-05-20 No fix listed CWE-862

TI-2023-01346 CVE-2023-1425 · GHSA-ch73-x6xh-8mrp

Groundhogg Contacts < 2.7.9.4 - Admin+ SQLi

HIGH 67

The WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg WordPress plugin before 2.7.9.4 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a…

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.0085 Published 2023-04-10 Fixed in 2.7.9.4

TI-2019-11742 CVE-2019-15647 · GHSA-jm9x-4pc8-3rv4

The groundhogg plugin before 1.3.5 for WordPress has…

MEDIUM 45

The groundhogg plugin before 1.3.5 for WordPress has wp-admin/admin-ajax.php?action=bulk_action_listener remote code execution.

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.04529 Published 2019-08-27 No fix listed CWE-94

Vulnerabilities

Filters