CVE-2026-18548
7.2HighPublished 15 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-79
Impact
Unauthenticated attackers can inject persistent web scripts that execute in visitors' or admins' browsers. They only need network access to submit data containing the malicious 'ref' parameter.
Root cause
The plugin fails to sanitize and escape user input supplied through the 'ref' parameter before storing and rendering it.
Affected systems
Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress up to and including 4.5.14
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Fix & remediation
Upgrade Groundhogg to version 4.5.15 or later. If you cannot patch immediately, disable the Groundhogg plugin via the WordPress admin dashboard or CLI.
$ wp plugin update groundhoggAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ref' parameter in all versions up to, and including, 4.5.14 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.