Veille CVE

Recherche « Unknown Groundhogg — CRM, Newsletters, and Marketing Automation »

3 CVE

Critique 0 Élevée 1 Moyenne 2 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Unknown Groundhogg — CRM, Newsletters, and Marketing Automation » ✕
  1. CVE-2026-81741 4.7 Moyenne

    Unknown Groundhogg — CRM, Newsletters, and Marketing Automation

    The Groundhogg — CRM, Newsletters, and Marketing Automation WordPress plugin before 4.7.2 does not restrict the redirect target of its email preference confirmation flow to the site's own host, allowing unauthenticated attackers to redirect visitors to an arbitrary external URL by way of a crafted link.

  2. CVE-2026-81660 8.8 Élevée

    Unknown Groundhogg — CRM, Newsletters, and Marketing Automation

    The Groundhogg — CRM, Newsletters, and Marketing Automation WordPress plugin before 4.5.13 does not validate or escape values submitted to some optional web form fields before storing them and outputting them back in an administrative area, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against high privilege users.

  3. CVE-2026-18387 6.5 Moyenne

    trainingbusinesspros Groundhogg — CRM, Newsletters, and Marketing Automation

    The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to generic SQL Injection via the 'tag_query' parameter in all versions up to, and including, 4.5.14 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with vendor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires the attacker to trigger the vulnerable Legacy_Contact_Query code path by submitting an unknown filter type (e.g. filters[0][0][type]=force_fallback), which causes a FilterException that dispatches execution away from the modern query handler.