CVE-2026-81660: Groundhogg < 4.5.13 - Unauthenticated Stored XSS via Web Form Dropdown/Radio Field
The Groundhogg — CRM, Newsletters, and Marketing Automation WordPress plugin before 4.5.13 does not validate or escape values submitted to some optional web form fields before storing them and outputting them back in an administrative area, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against high privilege users.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Sites using the Groundhogg WordPress plugin before version 4.5.13 are exposed when they use affected optional web form dropdown or radio fields. An unauthenticated visitor can submit the malicious value, but the payload is triggered when a high-privilege user views it in an administrative area.
What does an attacker need to exploit it?
The attacker does not need to authenticate. They need a reachable affected Groundhogg web form with optional dropdown or radio fields that accepts their submitted value.
How can I determine whether my site is affected?
Check the installed Groundhogg plugin version; versions before 4.5.13 are affected. Also review whether your Groundhogg forms use optional dropdown or radio fields and whether their submissions are viewed in the WordPress administrative area.