Groundhogg — CRM, Newsletters, and Marketing Automation

Vulnerabilities 27Slug groundhoggLatest version 4.4.1WordPress.org →

Minimum safe version

4.4.1

Update to 4.4.1 or later to address 27 fixable vulnerabilities

Latest available4.4.1 ✓
N/A
2026-04-24< 4.4.1

Groundhogg — CRM, Newsletters, and Marketing Automation < 4.4.1 - Missing Authorization

WordfenceCVE
N/A
2026-04-16< 4.4.1

Groundhogg — CRM, Newsletters, and Marketing Automation <= 4.4 - Authenticated (Sales Representative+) Arbitrary File Deletion

WordfenceCVE
High 7.2
2025-05-09< 4.1.2

WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg <= 4.1.1.2 - Authenticated (Administrator+) Arbitrary File Deletion

EUVDWordfenceCVE
Medium 5.5
2025-04-01< 4.0

Groundhogg <= 3.7.4.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via label Parameter

EUVDWordfenceCVE
High 8.8
2025-01-13< 3.7.3.6

Groundhogg <= 3.7.3.5 - Authenticated (Author+) Arbitrary File Upload via gh_big_file_upload Function

WordfenceCVE
High 8.0
2023-05-22< 2.7.10

WordPress Groundhogg Plugin <= 2.7.9.8 is vulnerable to Cross Site Request Forgery (CSRF)

PatchstackCVEWordfenceWPScan
N/A
< 2.0.9.11

Groundhogg &lt;= 2.0.8.1 - Authenticated Reflected XSS

WPScan
N/A
< 1.3.11.8

Groundhogg &lt;= 1.3.11.3 - Authenticated SQL Injection

WPScan
N/A
2019-09-10< 2.0.9.11

Groundhogg <= 2.0.8.1 - Reflected Cross-Site Scripting

Wordfence
N/A
2019-10-23< 2.0.8

Groundhogg <= 1.3.11.13 - SQL Injection

Wordfence