Does Groundhogg — CRM, Newsletters, and Marketing Automation have any unpatched vulnerabilities?

No. All known vulnerabilities in Groundhogg — CRM, Newsletters, and Marketing Automation have been patched as of the latest data update. Always keep the plugin updated to the latest version.

Is Groundhogg — CRM, Newsletters, and Marketing Automation compatible with WordPress 6.9.4?

According to WordPress.org data, Groundhogg — CRM, Newsletters, and Marketing Automation 4.3.2 has been tested up to WordPress 6.9.4. Check the plugin's changelog for the latest compatibility information.

Is Groundhogg — CRM, Newsletters, and Marketing Automation compatible with PHP 7.1+?

Groundhogg — CRM, Newsletters, and Marketing Automation requires PHP 7.1 or higher. Most modern WordPress hosts run PHP 8.1 or 8.2. If you are on an older PHP version, consider upgrading before installing this plugin.

Groundhogg — CRM, Newsletters, and Marketing Automation Security & Risk Analysis

wordpress.org/plugins/groundhogg

Groundhogg is the best WordPress CRM & Marketing Automation plugin. Create flows, email campaigns, and have a CRM all within your WordPress site.

2K active installs v4.3.2 PHP 7.1+ WP 5.9+ Updated Mar 9, 2026

crmemail-automationemail-marketingmarketing-automationwordpress-crm

A · Safe

CVEs total23

Unpatched0

Last CVENov 20, 2025

Plugin page Download

Safety Verdict

Is Groundhogg — CRM, Newsletters, and Marketing Automation Safe to Use in 2026?

Generally Safe

Score 88/100

Groundhogg — CRM, Newsletters, and Marketing Automation has a strong security track record. Known vulnerabilities have been patched promptly.

23 known CVEsLast CVE: Nov 20, 2025Updated 25d ago

Risk Assessment

The Groundhogg plugin version 4.3.2 exhibits a mixed security posture. While it demonstrates good practices in some areas, such as a high percentage of prepared SQL statements and properly escaped output, significant concerns exist. The substantial attack surface, with 65 entry points including 22 unprotected AJAX handlers, presents a considerable risk. The presence of a dangerous `unserialize` function and four high-severity unsanitized taint flows are particularly alarming and indicate potential vulnerabilities for deserialization attacks and path traversal or injection.

The plugin's vulnerability history, with 23 known CVEs including 9 high-severity ones and a recent last vulnerability in late 2025, suggests a pattern of recurring security weaknesses across various types, including deserialization, path traversal, XSS, CSRF, and SQL injection. This historical data, coupled with the current static analysis findings, points to an ongoing need for diligent security oversight and patching.

Overall, while the plugin has strengths in its use of prepared statements and output escaping, the high number of unprotected entry points, critical taint analysis findings, and a concerning vulnerability history necessitate caution. Administrators should prioritize regular updates and be aware of the potential risks associated with its extensive attack surface.

Key Concerns

22 unprotected AJAX handlers
4 high severity unsanitized taint flows
Dangerous function: unserialize
23 total known CVEs
9 high severity past CVEs
Bundled library: Select2

Vulnerabilities

Groundhogg — CRM, Newsletters, and Marketing Automation Security Vulnerabilities

CVEs by Year

3 CVEs in 2019

2019

10 CVEs in 2023

2023

2 CVEs in 2024

2024

8 CVEs in 2025

2025

Patched Has unpatched

Severity Breakdown

High

Medium

23 total CVEs

CVE-2025-12750medium · 4.9Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Groundhogg <= 4.2.6.1 - Authenticated (Admin+) SQL Injection

Nov 20, 2025 Patched in 4.2.7 (1d)

CVE-2025-64367medium · 6.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Groundhogg <= 4.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting

Oct 31, 2025 Patched in 4.2.6.1 (5d)

CVE-2025-54053high · 7.5Deserialization of Untrusted Data

Groundhogg <= 4.2.2 - Authenticated (Sales Representative+) PHP Object Injection

Aug 5, 2025 Patched in 4.2.2.1 (7d)

CVE-2025-48300high · 8.8Unrestricted Upload of File with Dangerous Type

Groundhogg <= 4.2.1 - Authenticated (Sales Rep+) Arbitrary File Upload

Jul 4, 2025 Patched in 4.2.2 (5d)

CVE-2025-4206high · 7.2Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg <= 4.1.1.2 - Authenticated (Administrator+) Arbitrary File Deletion

May 8, 2025 Patched in 4.1.2 (1d)

CVE-2025-1267medium · 5.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Groundhogg <= 3.7.4.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via label Parameter

Mar 31, 2025 Patched in 4.0 (1d)

CVE-2025-0394high · 8.8Unrestricted Upload of File with Dangerous Type

Groundhogg <= 3.7.3.5 - Authenticated (Author+) Arbitrary File Upload via gh_big_file_upload Function

Jan 13, 2025 Patched in 3.7.3.6 (1d)

CVE-2024-56289medium · 6.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Groundhogg <= 3.7.3.3 - Reflected Cross-Site Scripting

Jan 3, 2025 Patched in 3.7.3.4 (6d)

CVE-2024-37264medium · 6.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Groundhogg <= 3.4.2.3 - Reflected Cross-Site Scripting

Jun 27, 2024 Patched in 3.4.3 (6d)

CVE-2024-37235medium · 4.3Cross-Site Request Forgery (CSRF)

Groundhogg <= 3.4.2.3 - Cross-Site Request Forgery

Jun 21, 2024 Patched in 3.4.3 (6d)

CVE-2023-40681medium · 4.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Groundhogg <= 2.7.11.10 - Authenticated (Administrator+) Stored Cross-Site Scripting via Task Data

Oct 25, 2023 Patched in 2.7.11.11 (90d)

CVE-2023-34178medium · 5.4Cross-Site Request Forgery (CSRF)

Groundhogg <= 2.7.11 - Cross-Site Request Forgery

May 30, 2023 Patched in 2.7.11.1 (238d)

CVE-2023-34179high · 7.2Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Groundhogg <= 2.7.11 - Authenticated (Administrator+) SQL Injection

May 30, 2023 Patched in 2.7.11.1 (238d)

CVE-2023-2715medium · 4.3Missing Authorization

Groundhogg <= 2.7.9.8 - Missing Authorization to Admin Account and Ticket Creation