CVE-2026-18548: Groundhogg <= 4.5.14 - Unauthenticated Stored Cross-Site Scripting via 'ref' Parameter

Q: What does the CVSS vector indicate about exploitation prerequisites?

The vulnerability is network-accessible, has low attack complexity, requires no privileges, and does not require user interaction to deliver the attack. The injected script executes when a user later accesses an affected page.

Q: What is the expected security impact if exploitation succeeds?

The CVSS vector indicates low confidentiality and integrity impact, no availability impact, and a changed scope. Successful exploitation allows arbitrary web scripts to run in the context of users viewing an injected page.

Published Oct 15, 2026

Updated

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ref' parameter in all versions up to, and including, 4.5.14 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Affected Software

1 affected component

Groundhogg Groundhogg<=4.5.14

Event History

Oct 15, 2026

CVE Published

via MITRE·05:30 AM

Data Sourced

via MITRE·05:30 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What does the CVSS vector indicate about exploitation prerequisites?

The vulnerability is network-accessible, has low attack complexity, requires no privileges, and does not require user interaction to deliver the attack. The injected script executes when a user later accesses an affected page.

What is the expected security impact if exploitation succeeds?