392 matches found
CVE-2026-92975
The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.8.3 via the createsupportuser function. This is due to the function identifying the support account solely by matching against publicly...
CVE-2026-104725
The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.9 This is due to a missing ownership and capability check on the user parameter within the processedit function, which allows any...
CVE-2026-92975 Groundhogg <= 4.8.3 - Unauthenticated Privilege Escalation to Support User Identity Confusion
The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.8.3 via the createsupportuser function. This is due to the function identifying the support account solely by matching against publicly...
CVE-2026-92975 Groundhogg <= 4.8.3 - Unauthenticated Privilege Escalation to Support User Identity Confusion
The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.8.3 via the createsupportuser function. This is due to the function identifying the support account solely by matching against publicly...
CVE-2026-92975
The Groundhogg CRM, Newsletters, and Marketing Automation plugin for WordPress (versions ≤ 4.8.3 ) contains a Privilege Escalation vulnerability in the create_support_user() function. The flaw exists because the function identifies support accounts using publicly hardcoded constants—specifically ...
EUVD-2026-96105
The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.8.3 via the createsupportuser function. This is due to the function identifying the support account solely by matching against publicly...
CVE-2026-104725 Groundhogg <= 4.9 - Authenticated (Custom+) Privilege Escalation to 'user' Parameter
The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.9 This is due to a missing ownership and capability check on the user parameter within the processedit function, which allows any...
CVE-2026-104725 Groundhogg <= 4.9 - Authenticated (Custom+) Privilege Escalation to 'user' Parameter
The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.9 This is due to a missing ownership and capability check on the user parameter within the processedit function, which allows any...
EUVD-2026-96095
The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.9 This is due to a missing ownership and capability check on the user parameter within the processedit function, which allows any...
CVE-2026-104725
The Groundhogg WordPress plugin (versions up to and including 4.9 ) is vulnerable to Privilege Escalation due to a missing ownership and capability check on the user parameter within the process_edit() function. This flaw allows authenticated users with the edit_contacts capability to reassign a ...
WordPress Groundhogg — CRM, Newsletters, and Marketing Automation plugin <= 4.8.3 - Unauthenticated Privilege Escalation to Support User Identity Confusion vulnerability
Unauthenticated Privilege Escalation to Support User Identity Confusion vulnerability discovered by Wordfence PRISM in WordPress Plugin Groundhogg versions = 4.8.3...
WordPress Groundhogg — CRM, Newsletters, and Marketing Automation plugin <= 4.9 - Authenticated (Custom+) Privilege Escalation to 'user' Parameter vulnerability
Authenticated Custom+ Privilege Escalation to 'user' Parameter vulnerability discovered by Wordfence PRISM in WordPress Plugin Groundhogg versions = 4.9...
CVE-2024-56289
CVE-2024-56289 1️⃣ Component type WordPress plugin 2️⃣ Component details Component name WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg Vulnerable version Since this plugin uses the REST API, the Permalink must be set to Post name. 2. Subsequently, accessing...
CVE-2026-106603
Authorization Bypass Through User-Controlled Key vulnerability in Groundhogg HollerBox holler-box allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HollerBox: from n/a through 2.3.14...
EUVD-2026-94930
Authorization Bypass Through User-Controlled Key vulnerability in Groundhogg HollerBox holler-box allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HollerBox: from n/a through 2.3.14...
CVE-2026-104385
Unauthenticated Sensitive Data Exposure in Groundhogg = 4.8.3 versions...
EUVD-2026-93072
Unauthenticated Sensitive Data Exposure in Groundhogg = 4.8.3 versions...
CVE-2026-104385 WordPress Groundhogg plugin <= 4.8.3 - Sensitive Data Exposure vulnerability
Unauthenticated Sensitive Data Exposure in Groundhogg = 4.8.3 versions...