High
CVE-2026-92975
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41
Reset filters
High
CVE-2026-104725
Groundhogg <= 4.9 - Authenticated (Custom+) Privilege Escalation to 'user' Parameter
Medium
CVE-2026-104385
Groundhogg — CRM, Newsletters, and Marketing Automation <= 4.8.3 - Unauthenticated Information Exposure
Medium
CVE-2026-104408
Groundhogg — CRM, Newsletters, and Marketing Automation <= 4.8.3 - Authenticated (Custom Role+) SQL Injection
High
CVE-2026-97644
Groundhogg <= 4.9 - Authenticated (Sales Person+) Privilege Escalation via Contact Identity Rebinding leading to Administrator Account Takeover to 'user_id' Parameter (v3 /contacts) chained with v4 /emails/test
Medium
CVE-2026-85310
Groundhogg — CRM, Newsletters, and Marketing Automation <= 4.7.1 - Authenticated (Import_contacts+) Path Traversal
Medium
CVE-2026-81741
Groundhogg — CRM, Newsletters, and Marketing Automation < 4.7.2 - Unauthenticated Open Redirect
High
CVE-2026-81660
Groundhogg — CRM, Newsletters, and Marketing Automation < 4.5.13 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-18387
Groundhogg <= 4.5.14 - Authenticated (Vendor+) SQL Injection via 'tag_query' Parameter
Medium
CVE-2026-11454
Groundhogg — CRM, Newsletters, and Marketing Automation <= 4.5.2 - Insecure Direct Object Reference
High
CVE-2026-57389
Groundhogg — CRM, Newsletters, and Marketing Automation <= 4.4.1 - Authenticated (Sales Representative+) Arbitrary File Deletion
Medium
CVE-2026-14029
Groundhogg <= 4.5.8 - Authenticated (Custom+) SQL Injection via 'select' Parameter
Medium
CVE-2026-13333
Groundhogg <= 4.5.5 - Authenticated (Sales Rep+) SQL Injection via 'query[select]' Parameter
Medium
CVE-2026-13331
Groundhogg <= 4.5.5 - Authenticated (Marketer+) SQL Injection via 'search' Parameter
Medium
CVE-2026-57667
Groundhogg — CRM, Newsletters, and Marketing Automation <= 4.5 - Authenticated (Sales representative+) SQL Injection
Medium
CVE-2026-13226
Groundhogg <= 4.5.4 - Authenticated (Custom+) SQL Injection via 'after' Parameter
Medium
CVE-2026-40793
Groundhogg — CRM, Newsletters, and Marketing Automation < 4.4.1 - Missing Authorization
High
CVE-2026-40727
Groundhogg — CRM, Newsletters, and Marketing Automation <= 4.4 - Authenticated (Sales Representative+) Arbitrary File Deletion
Medium
CVE-2025-12750
Groundhogg <= 4.2.6.1 - Authenticated (Admin+) SQL Injection
Medium
CVE-2025-64367
Groundhogg <= 4.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2025-54053
Groundhogg <= 4.2.2 - Authenticated (Sales Representative+) PHP Object Injection
High
CVE-2025-48300
Groundhogg <= 4.2.1 - Authenticated (Sales Rep+) Arbitrary File Upload
High
CVE-2025-4206
WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg <= 4.1.1.2 - Authenticated (Administrator+) Arbitrary File Deletion
Medium
CVE-2025-1267
Groundhogg <= 3.7.4.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via label Parameter
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.