CVE-2026-81660: CWE-79 Cross-Site Scripting (XSS) in Groundhogg — CRM, Newsletters, and Marketing Automation

CVE-2026-81660 is a Stored Cross-Site Scripting vulnerability (CWE-79) in the Groundhogg — CRM, Newsletters, and Marketing Automation WordPress plugin versions prior to 4.5.13. The vulnerability arises because the plugin fails to validate or escape input values submitted to some optional web form fields before storing and rendering them in an administrative area. This allows unauthenticated attackers to inject malicious scripts that execute in the context of high privilege users' browsers when they access the affected admin pages.

Successful exploitation can lead to the execution of arbitrary scripts in the context of high privilege administrative users. This can result in full compromise of the administrative interface, including theft of credentials, session hijacking, or other administrative actions. The CVSS score of 8.8 indicates a high severity with network attack vector, no privileges required, low attack complexity, and high impact on confidentiality, integrity, and availability.

No official patch or remediation level is currently confirmed. Users should upgrade to Groundhogg version 4.5.13 or later once available, as the vulnerability affects versions before 4.5.13. Until a fix is confirmed, restrict access to the administrative interface and monitor for suspicious activity. Check the vendor advisory for updates on patch availability.