Groundhogg vulnerabilities and threats

3 threats

Severity	CVSS	Signals	Threat	Source	Published
Medium	6.5	EPSS 0.2%	CVE-2026-106603HollerBox (WordPress plugin) · Insecure Direct Object Reference Medium6.5EPSS 0.2%2026-10-08CVE Database V5CVE-2026-106603 CVE-2026-106603 is an authorization bypass vulnerability in Groundhogg HollerBox versions prior to 2.3.15. The flaw allows attackers to exploit incorrectly configured access control security levels by manipulating a user-controlled key. This vulnerability can lead to unauthorized actions that impact the integrity and availability of the affected system. The issue has a medium severity rating with a CVSS score of 6.5. EPSS 0.2%Vulnerability Groundhogg	CVE Database V5	2026-10-08
High	7.1	EPSS 0.2%	CVE-2026-48885HollerBox (WordPress plugin) · Cross-site Scripting High7.1EPSS 0.2%2026-06-15CVE Database V5CVE-2026-48885 Unauthenticated Cross Site Scripting (XSS) in HollerBox <= 2.3.10.1 versions. EPSS 0.2%Vulnerability Groundhogg CWE-79	CVE Database V5	2026-06-15
High	7.1	EPSS 0.3%	CVE-2024-37264Groundhogg (WordPress plugin) · XSS or 'Cross-site Scripting' High7.1EPSS 0.3%2024-07-22CVE Database V5CVE-2024-37264 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Groundhogg Inc. Groundhogg allows Reflected XSS.This issue affects Groundhogg: from n/a through 3.4.2.3. EPSS 0.3%Vulnerability CWE-79	CVE Database V5	2024-07-22

Page 1 of 1