CVE-2025-1267: Groundhogg WordPress Plugin XSS Vulnerability

CVE-2025-1267 Overview

The Groundhogg plugin for WordPress contains a stored Cross-Site Scripting (XSS) vulnerability affecting versions up to and including 3.7.4.1. The flaw stems from insufficient input sanitization and output escaping on the label parameter within the plugin's form builder. Authenticated attackers with Administrator-level access can inject arbitrary web scripts that execute when users access affected pages. The issue is scoped to WordPress multi-site installations and single-site installations where unfiltered_html has been disabled. This vulnerability is tracked as [CWE-79] (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Stored JavaScript payloads persist within Groundhogg form definitions and execute in the context of any user rendering the affected page, enabling session hijacking or administrative action abuse in multi-site environments.

Affected Products

Groundhogg plugin for WordPress versions up to and including 3.7.4.1
WordPress multi-site installations running vulnerable Groundhogg versions
WordPress installations with unfiltered_html capability disabled

Discovery Timeline

2025-04-01 - CVE-2025-1267 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-1267

Vulnerability Analysis

The vulnerability resides in the Groundhogg form builder component. The plugin accepts a label parameter from administrators when configuring form fields and funnel steps. The parameter is stored in the database and later rendered without adequate sanitization or output escaping. When the affected page is loaded, the browser interprets attacker-controlled content as executable script.

Because WordPress Administrators normally hold the unfiltered_html capability, standard single-site installations are not affected. Multi-site installations restrict this capability by default, and hardened single-site deployments may explicitly disable it. In these environments, the input handling in Groundhogg becomes the security boundary, and it fails to filter script content from the label field.

Root Cause

The root cause is missing sanitization on write and missing escaping on output for the label parameter processed in assets/js/admin/forms/form-builder-v2.js. The plugin trusted the string value without applying context-appropriate encoding when rendering it back into HTML.

Attack Vector

An attacker requires an authenticated session with Administrator-level privileges on a target site. The attacker submits a Groundhogg form or funnel step configuration containing script content in the label field. The payload is persisted in the database. Subsequent visits to the page containing the injected label trigger execution of the stored script in each visitor's browser session, including higher-privileged users on multi-site networks.

The upstream fix, referenced in WordPress Changeset 3264477 and the GitHub commit, introduces a Funnel_Step schema to validate and sanitize settings before persistence.

php

// Excerpt from includes/functions.php after the fix
// Might be a float
// Might be int
// if first digit is 0, treat as string
if ( is_numeric( $param ) && ! str_starts_with( "$param", '0' ) ) {
    // No sanitization needed
}

Source: groundhoggwp/groundhogg commit 5206bf2

Detection Methods for CVE-2025-1267

Indicators of Compromise

Groundhogg form or funnel step records where the label field contains HTML tags such as <script>, <img onerror=, or javascript: URIs.
Unexpected outbound requests from administrator browser sessions to attacker-controlled domains after loading Groundhogg admin pages.
New or modified administrator accounts on multi-site networks following Groundhogg edits by lower-tier site administrators.

Detection Strategies

Audit the wp_options, wp_postmeta, and Groundhogg-specific tables for stored label values containing script or event-handler content.
Review WordPress audit logs for form or funnel edits performed by administrators near the reported publication date.
Compare running Groundhogg versions against the fixed release using WP-CLI: wp plugin get groundhogg --field=version.

Monitoring Recommendations

Alert on administrator-level POST requests to Groundhogg REST endpoints under /wp-json/gh/v4/ that include HTML markup in the label parameter.
Enable Content Security Policy reporting on WordPress admin pages to surface unexpected inline script execution.
Monitor multi-site network activity for cross-site privilege changes originating from a single administrator session.

How to Mitigate CVE-2025-1267

Immediate Actions Required

Upgrade the Groundhogg plugin to a version later than 3.7.4.1 on all WordPress sites, prioritizing multi-site networks.
Review existing Groundhogg forms and funnel steps and remove any label values containing HTML or script content.
Rotate administrator credentials on multi-site installations that permitted untrusted admins to edit Groundhogg configurations.

Patch Information

The vendor released a fix in WordPress Changeset 3264477, corresponding to the GitHub commit 5206bf2. The patch introduces a Funnel_Step schema that enforces validation and sanitization on stored settings. Additional details are available in the Wordfence Vulnerability Report.

Workarounds

Restrict administrator access on multi-site networks so that only trusted network administrators can edit Groundhogg forms and funnels.
Deploy a web application firewall rule that blocks POST requests to Groundhogg admin endpoints containing <script, onerror=, or javascript: in the label parameter.
Apply a strict Content Security Policy on the WordPress admin interface to prevent inline script execution.

bash

# Update Groundhogg using WP-CLI on each site in a multi-site network
wp plugin update groundhogg --network
wp plugin get groundhogg --field=version