Groundhogg — CRM, Newsletters, and Marketing Automation

Güvenlik açıkları

• CVE-2025-48300yüksek yetki≤ 4.2.1

  WordPress Groundhogg plugin <= 4.2.1 - Arbitrary File Upload vulnerability

  Kritik 9.1

• CVE-2023-34178kimlik doğrulamasız · tıklama gerekir≤ 2.7.11

  WordPress Groundhogg Plugin <= 2.7.11 is vulnerable to Cross Site Request Forgery (CSRF)

  Yüksek 8.8

• CVE-2026-97644giriş gerekir≤ 4.9

  Groundhogg <= 4.9 - Authenticated (Sales Person+) Privilege Escalation via Contact Identity Rebinding leading to Administrator Account Takeover to 'user_id' Par

  Yüksek 8.8

• CVE-2019-15647giriş gerekir

  The groundhogg plugin before 1.3.5 for WordPress has wp-admin/admin-ajax.php?action=bulk_action_listener remote code execution.

  Yüksek 8.8

• CVE-2025-0394yazar+≤ 3.7.3.5

  Groundhogg <= 3.7.3.5 - Authenticated (Author+) Arbitrary File Upload via gh_big_file_upload Function

  Yüksek 8.8

• CVE-2026-57389kimlik doğrulamasız≤ 4.4.1

  WordPress Groundhogg plugin <= 4.4.1 - Arbitrary File Deletion vulnerability

  Yüksek 8.6

• CVE-2026-57667giriş gerekir≤ 4.5

  WordPress Groundhogg plugin <= 4.5 - SQL Injection vulnerability

  Yüksek 8.5

• CVE-2023-2736giriş gerekir≤ 2.7.9.8

  Groundhogg <= 2.7.9.8 - Cross-Site Request Forgery to Privilege Escalation

  Yüksek 8.0

• CVE-2026-40727giriş gerekir≤ 4.4

  WordPress Groundhogg plugin <= 4.4 - Arbitrary File Deletion vulnerability

  Yüksek 7.7

• CVE-2025-4206yönetici≤ 4.1.1.2

  WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg <= 4.1.1.2 - Authenticated (Administrator+) Arbitrary File Deletion

  Yüksek 7.2

• CVE-2023-34179yüksek yetki≤ 2.7.11

  WordPress Groundhogg Plugin <= 2.7.11 is vulnerable to SQL Injection

  Yüksek 7.2

• CVE-2024-56289kimlik doğrulamasız · tıklama gerekir≤ 3.7.3.3

  WordPress Groundhogg plugin <= 3.7.3.3 - Reflected Cross Site Scripting (XSS) vulnerability

  Yüksek 7.1

• CVE-2025-54053yüksek yetki≤ 4.2.2

  WordPress Groundhogg plugin <= 4.2.2 - PHP Object Injection vulnerability

  Orta 6.6

• CVE-2026-85310giriş gerekir≤ 4.7.1

  WordPress Groundhogg plugin <= 4.7.1 - Path Traversal vulnerability

  Orta 6.5

• CVE-2026-18387giriş gerekir≤ 4.5.14

  Groundhogg <= 4.5.14 - Authenticated (Vendor+) SQL Injection via 'tag_query' Parameter

  Orta 6.5

• CVE-2026-11454giriş gerekir≤ 4.5.2

  Groundhogg — CRM, Newsletters, and Marketing Automation <= 4.5.2 - Insecure Direct Object Reference

  Orta 6.5

• CVE-2026-14029giriş gerekir≤ 4.5.8

  Groundhogg <= 4.5.8 - Authenticated (Custom+) SQL Injection via 'select' Parameter

  Orta 6.5

• CVE-2026-13333giriş gerekir≤ 4.5.5

  Groundhogg <= 4.5.5 - Authenticated (Sales Rep+) SQL Injection via 'query[select]' Parameter

  Orta 6.5

• CVE-2026-13331giriş gerekir≤ 4.5.5

  Groundhogg <= 4.5.5 - Authenticated (Marketer+) SQL Injection via 'search' Parameter

  Orta 6.5

• CVE-2026-13226giriş gerekir≤ 4.5.4

  Groundhogg <= 4.5.4 - Authenticated (Custom+) SQL Injection via 'after' Parameter

  Orta 6.5

• CVE-2026-40793abone+→ 4.4.1

  WordPress Groundhogg plugin < 4.4.1 - Broken Access Control vulnerability

  Orta 6.5

• CVE-2025-64367giriş gerekir≤ 4.2.6

  WordPress Groundhogg plugin <= 4.2.6 - Cross Site Scripting (XSS) vulnerability

  Orta 6.5

• CVE-2024-37264kimlik doğrulamasız · tıklama gerekir≤ 3.4.2.3

  WordPress Groundhogg plugin <= 3.4.2.3 - Reflected Cross Site Scripting (XSS) vulnerability

  Orta 6.1

• CVE-2025-1267yönetici≤ 3.7.4.1

  Groundhogg <= 3.7.4.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via label Parameter

  Orta 5.5

• CVE-2023-2716abone+≤ 2.7.9.8

  Groundhogg <= 2.7.9.8 - Missing Authorization to Non-Arbitrary File Upload

  Orta 5.4

• CVE-2023-2735katılımcı+≤ 2.7.9.8

  Groundhogg <= 2.7.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

  Orta 5.4

• CVE-2025-12750yönetici≤ 4.2.6.1

  Groundhogg <= 4.2.6.1 - Authenticated (Admin+) SQL Injection

  Orta 4.9

• CVE-2023-40681yönetici≤ 2.7.11.10

  WordPress Groundhogg Plugin <= 2.7.11.10 is vulnerable to Cross Site Scripting (XSS)

  Orta 4.8

• CVE-2024-37235kimlik doğrulamasız · tıklama gerekir≤ 3.4.2.3

  WordPress Groundhogg plugin <= 3.4.2.3 - Cross Site Request Forgery (CSRF) vulnerability

  Orta 4.3

• CVE-2023-2717kimlik doğrulamasız · tıklama gerekir≤ 2.7.9.8

  Groundhogg <= 2.7.9.8 - Cross-Site Request Forgery to Disable All Plugins

  Orta 4.3

• CVE-2023-2715giriş gerekir≤ 2.7.8.9

  Groundhogg <= 2.7.9.8 - Missing Authorization to Admin Account and Ticket Creation

  Orta 4.3

• CVE-2023-2714abone+≤ 2.7.9.8

  Groundhogg <= 2.7.9.8 - Missing Authorization to Update License

  Orta 4.3