Plugin security history

Groundhogg — CRM, Newsletters, and Marketing Automation Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 31 vulnerability records associated with Groundhogg — CRM, Newsletters, and Marketing Automation, published between 2019 and 2026.

Dataset last synchronized: 2026-08-03 00:31:25 UTC

At a glance

Security Snapshot

31Total records

0Critical

11High

20Medium

0Low

0Informational

31Patched records

0Currently marked unpatched

2019-04-08First disclosure

2026-07-08Latest disclosure

29 of 31CVE coverage

Year-by-Year Timeline

Year	Records	Relative volume
2019	3	3 records
2023	10	10 records
2024	2	2 records
2025	8	8 records
2026	8	8 records

Severity Breakdown

Severity	Records	Share
High	11	35.5%
Medium	20	64.5%

Vulnerability-Type Breakdown

SQL Injection

9 records29%

First: 2019. Latest: 2026.

Cross-Site Scripting

7 records22.6%

First: 2019. Latest: 2025.

Missing Authorization

4 records12.9%

First: 2023. Latest: 2026.

CSRF

4 records12.9%

First: 2023. Latest: 2024.

Path Traversal

3 records9.7%

First: 2025. Latest: 2026.

Other

2 records6.5%

First: 2019. Latest: 2025.

Arbitrary File Upload

2 records6.5%

First: 2025. Latest: 2025.

Patch Status

Patched: 31
Currently marked unpatched: 0
Unknown status: 0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

4.5
4.5.9
4.5.6
4.5.1
4.5.5
4.4.1
4.2.7
4.2.6.1
4.2.2.1
4.2.2
4.1.2
4.0
3.7.3.6
3.7.3.4
3.4.3
2.7.11.11
2.7.11.1
2.7.10
2.7.9.4
2.0.8
2.0.9.11
1.3.5

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected range	Vulnerability	Published	Patched version	Severity
`*-4.4.1`	Groundhogg — CRM, Newsletters, and Marketing Automation <= 4.4.1 - Authenticated (Sales Representative+) Arbitrary File Deletion	July 8, 2026	4.5	High
`*-4.5.8`	Groundhogg <= 4.5.8 - Authenticated (Custom+) SQL Injection via 'select' Parameter	July 1, 2026	4.5.9	Medium
`*-4.5.5`	Groundhogg <= 4.5.5 - Authenticated (Sales Rep+) SQL Injection via 'query[select]' Parameter	June 26, 2026	4.5.6	Medium
`*-4.5.5`	Groundhogg <= 4.5.5 - Authenticated (Marketer+) SQL Injection via 'search' Parameter	June 26, 2026	4.5.6	Medium
`*-4.5`	Groundhogg — CRM, Newsletters, and Marketing Automation <= 4.5 - Authenticated (Sales representative+) SQL Injection	June 26, 2026	4.5.1	Medium
`*-4.5.4`	Groundhogg <= 4.5.4 - Authenticated (Custom+) SQL Injection via 'after' Parameter	June 25, 2026	4.5.5	Medium
`[*, 4.4.1)`	Groundhogg — CRM, Newsletters, and Marketing Automation < 4.4.1 - Missing Authorization	April 24, 2026	4.4.1	Medium
`*-4.4`	Groundhogg — CRM, Newsletters, and Marketing Automation <= 4.4 - Authenticated (Sales Representative+) Arbitrary File Deletion	April 16, 2026	4.4.1	High
`*-4.2.6.1`	Groundhogg <= 4.2.6.1 - Authenticated (Admin+) SQL Injection	November 20, 2025	4.2.7	Medium
`*-4.2.6`	Groundhogg <= 4.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting	October 31, 2025	4.2.6.1	Medium
`*-4.2.2`	Groundhogg <= 4.2.2 - Authenticated (Sales Representative+) PHP Object Injection	August 5, 2025	4.2.2.1	High
`*-4.2.1`	Groundhogg <= 4.2.1 - Authenticated (Sales Rep+) Arbitrary File Upload	July 4, 2025	4.2.2	High
`*-4.1.1.2`	WordPress CRM, Email & Marketing Automation for WordPress \| Award Winner — Groundhogg <= 4.1.1.2 - Authenticated (Administrator+) Arbitrary File Deletion	May 8, 2025	4.1.2	High
`*-3.7.4.1`	Groundhogg <= 3.7.4.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via label Parameter	March 31, 2025	4.0	Medium
`*-3.7.3.5`	Groundhogg <= 3.7.3.5 - Authenticated (Author+) Arbitrary File Upload via gh_big_file_upload Function	January 13, 2025	3.7.3.6	High
`*-3.7.3.3`	Groundhogg <= 3.7.3.3 - Reflected Cross-Site Scripting	January 3, 2025	3.7.3.4	Medium
`*-3.4.2.3`	Groundhogg <= 3.4.2.3 - Reflected Cross-Site Scripting	June 27, 2024	3.4.3	Medium
`*-3.4.2.3`	Groundhogg <= 3.4.2.3 - Cross-Site Request Forgery	June 21, 2024	3.4.3	Medium
`*-2.7.11.10`	Groundhogg <= 2.7.11.10 - Authenticated (Administrator+) Stored Cross-Site Scripting via Task Data	October 25, 2023	2.7.11.11	Medium
`*-2.7.11`	Groundhogg <= 2.7.11 - Authenticated (Administrator+) SQL Injection	May 30, 2023	2.7.11.1	High
`*-2.7.11`	Groundhogg <= 2.7.11 - Cross-Site Request Forgery	May 30, 2023	2.7.11.1	Medium
`*-2.7.9.8`	Groundhogg <= 2.7.9.8 - Cross-Site Request Forgery to Disable All Plugins	May 19, 2023	2.7.10	Medium
`*-2.7.9.8`	Groundhogg <= 2.7.9.8 - Cross-Site Request Forgery to Privilege Escalation	May 19, 2023	2.7.10	High
`*-2.7.9.8`	Groundhogg <= 2.7.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode	May 19, 2023	2.7.10	Medium
`*-2.7.9.8`	Groundhogg <= 2.7.9.8 - Missing Authorization to Non-Arbitrary File Upload	May 19, 2023	2.7.10	Medium

Selected source records

Latest Records

HighCVE-2026-57389

Groundhogg — CRM, Newsletters, and Marketing Automation <= 4.4.1 - Authenticated (Sales Representative+) Arbitrary File Deletion

Published: July 8, 2026

Affected versions: *-4.4.1
Patched versions: 4.5

Original Wordfence record

MediumCVE-2026-14029

Groundhogg <= 4.5.8 - Authenticated (Custom+) SQL Injection via 'select' Parameter

Published: July 1, 2026

Affected versions: *-4.5.8
Patched versions: 4.5.9

Original Wordfence record

MediumCVE-2026-13333

Groundhogg <= 4.5.5 - Authenticated (Sales Rep+) SQL Injection via 'query[select]' Parameter

Published: June 26, 2026

Affected versions: *-4.5.5
Patched versions: 4.5.6

Original Wordfence record

MediumCVE-2026-57667

Groundhogg — CRM, Newsletters, and Marketing Automation <= 4.5 - Authenticated (Sales representative+) SQL Injection

Published: June 26, 2026

Affected versions: *-4.5
Patched versions: 4.5.1

Original Wordfence record

MediumCVE-2026-13331

Groundhogg <= 4.5.5 - Authenticated (Marketer+) SQL Injection via 'search' Parameter

Published: June 26, 2026

Affected versions: *-4.5.5
Patched versions: 4.5.6

Original Wordfence record

MediumCVE-2026-13226

Groundhogg <= 4.5.4 - Authenticated (Custom+) SQL Injection via 'after' Parameter

Published: June 25, 2026

Affected versions: *-4.5.4
Patched versions: 4.5.5

Original Wordfence record

MediumCVE-2026-40793

Groundhogg — CRM, Newsletters, and Marketing Automation < 4.4.1 - Missing Authorization

Published: April 24, 2026

Affected versions: [*, 4.4.1)
Patched versions: 4.4.1

Original Wordfence record

HighCVE-2026-40727

Groundhogg — CRM, Newsletters, and Marketing Automation <= 4.4 - Authenticated (Sales Representative+) Arbitrary File Deletion

Published: April 16, 2026

Affected versions: *-4.4
Patched versions: 4.4.1

Original Wordfence record

Highest-Severity Records

HighCVE-2019-15647

WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg < 1.3.5 - Remote Code Execution

Published: April 8, 2019

Affected versions: [*, 1.3.5)
Patched versions: 1.3.5

Original Wordfence record

HighCVE-2025-48300

Groundhogg <= 4.2.1 - Authenticated (Sales Rep+) Arbitrary File Upload

Published: July 4, 2025

Affected versions: *-4.2.1
Patched versions: 4.2.2

Original Wordfence record

HighCVE-2025-0394

Groundhogg <= 3.7.3.5 - Authenticated (Author+) Arbitrary File Upload via gh_big_file_upload Function

Published: January 13, 2025

Affected versions: *-3.7.3.5
Patched versions: 3.7.3.6

Original Wordfence record

High

Groundhogg <= 1.3.11.13 - SQL Injection

Published: October 23, 2019

Affected versions: *-1.3.11.13
Patched versions: 2.0.8

Original Wordfence record

HighCVE-2026-57389

Groundhogg — CRM, Newsletters, and Marketing Automation <= 4.4.1 - Authenticated (Sales Representative+) Arbitrary File Deletion

Published: July 8, 2026

Affected versions: *-4.4.1
Patched versions: 4.5

Original Wordfence record

HighCVE-2026-40727

Groundhogg — CRM, Newsletters, and Marketing Automation <= 4.4 - Authenticated (Sales Representative+) Arbitrary File Deletion

Published: April 16, 2026

Affected versions: *-4.4
Patched versions: 4.4.1

Original Wordfence record

HighCVE-2025-54053

Groundhogg <= 4.2.2 - Authenticated (Sales Representative+) PHP Object Injection

Published: August 5, 2025

Affected versions: *-4.2.2
Patched versions: 4.2.2.1

Original Wordfence record

HighCVE-2023-2736

Groundhogg <= 2.7.9.8 - Cross-Site Request Forgery to Privilege Escalation

Published: May 19, 2023

Affected versions: *-2.7.9.8
Patched versions: 2.7.10

Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware Removal WordPress Security Maintenance Contact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory