WordPress Plugin Vulnerabilities

Groundhogg < 4.5.13 - Unauthenticated Stored XSS via Web Form Dropdown/Radio Field

Description

The plugin does not validate or escape values submitted to some optional web form fields before storing them and outputting them back in an administrative area, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against high privilege users.

Proof of Concept

Affects Plugins

Plugin icon
groundhogg
Fixed in 4.5.13

References

CVE
CVE-2026-81660

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
8.8 (high)

Miscellaneous

Original Researcher
Artus KG
Submitter
Artus KG
Submitter twitter
artuskg
Verified
Yes
WPVDB ID
cfdb4107-6010-4c29-baf3-3111765f48c2

Timeline

Publicly Published
2026-08-28 (about 2 days ago)
Added
2026-08-28 (about 1 day ago)
Last Updated
2026-08-28 (about 1 day ago)

Other

Published
Title
Published
2025-09-05
Title
Custom Team Manager <= 2.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2025-05-07
Title
WP jQuery DataTable <= 4.1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
Published
2025-01-24
Title
Flexmls® IDX Plugin < 3.14.27 - Authenticated (Contributor+) Stored Cross-Site Scripting via API parameters
Published
2025-01-14
Title
WP Bulletin Board <= 1.1.4 - Reflected Cross-Site Scripting
Published
2022-11-23
Title
Activello <= 1.4.4 - Reflected XSS