CVE-2026-18548: Groundhogg WordPress Plugin XSS Vulnerability

CVE-2026-18548 Overview

CVE-2026-18548 is a Stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the Groundhogg CRM, Newsletters, and Marketing Automation plugin for WordPress. The flaw affects all versions up to and including 4.5.14 and stems from insufficient input sanitization and output escaping on the ref parameter. Unauthenticated attackers can inject arbitrary JavaScript that executes when any user views an affected page. The issue was patched in version 4.5.15 through the addition of HTML escaping in the contact editor activity renderer.

Critical Impact
Unauthenticated attackers can inject persistent JavaScript payloads that execute in administrator browsers, enabling session theft, privilege escalation, and site takeover.

Affected Products

Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress
All versions up to and including 4.5.14
Fixed in version 4.5.15

Discovery Timeline

2026-10-15 - CVE-2026-18548 published to the National Vulnerability Database
2026-10-15 - Last updated in NVD database

Technical Details for CVE-2026-18548

Vulnerability Analysis

The vulnerability resides in the Groundhogg contact editor's activity rendering logic, specifically in assets/js/admin/contacts/contact-editor.js. When the plugin renders page visit activity entries, it interpolates the activity.data.path value directly into an HTML template string without escaping. Because the ref parameter is captured during visitor tracking and later displayed inside the administrator contact view, an unauthenticated attacker can seed malicious markup by visiting a tracked URL with a crafted ref value. The payload persists in the plugin's activity data and executes whenever an administrator opens the affected contact record.

Root Cause

The root cause is missing output escaping in a JavaScript template literal. The vulnerable code built an anchor tag using unescaped user input in both the href attribute and the link text. The patch introduces an escHTML() wrapper around the activity.data.path value in both the readable and minified builds of the contact editor script.

Attack Vector

Exploitation requires no authentication and no user interaction beyond an administrator viewing the compromised contact record. An attacker submits a tracked request containing a malicious ref parameter, Groundhogg stores the value as part of the visitor's activity history, and the stored payload fires in the context of the WordPress admin session.

javascript

// Patch in assets/js/admin/contacts/contact-editor.js
${ sprintf(
  /* translators: %s: a url/path */
  __('Visited %s', 'groundhogg'),
- `<a href="${ activity.data.path }" target="_blank">${ bold(
-        activity.data.path) }</a>`) }
+ `<a href="${ escHTML( activity.data.path ) }" target="_blank">${ bold(
+        escHTML( activity.data.path) ) }</a>`) }
// Source: https://github.com/groundhoggwp/groundhogg/commit/8a6fe60e751e

Detection Methods for CVE-2026-18548

Indicators of Compromise

Groundhogg contact activity entries containing HTML tags, <script> fragments, or javascript: URIs in the path field.
Web server access logs showing requests with HTML-encoded or script-bearing values in the ref query parameter.
Unexpected outbound requests from administrator browsers immediately after opening a contact record in wp-admin.

Detection Strategies

Query the Groundhogg activity tables for stored path values matching regex patterns such as <[a-z]+, onerror=, or javascript:.
Inspect historical WordPress access logs for ref parameter values containing angle brackets, encoded script tags, or event handler attributes.
Monitor the WordPress admin DOM for script execution originating from the contact editor view.

Monitoring Recommendations

Enable a Web Application Firewall rule set that flags XSS payloads in query string parameters, with specific coverage for ref.
Alert on administrator session anomalies such as unexpected API calls to wp-json/wp/v2/users or password changes shortly after viewing a contact.
Track the installed Groundhogg version across managed WordPress sites and alert on any instance below 4.5.15.

How to Mitigate CVE-2026-18548

Immediate Actions Required

Upgrade the Groundhogg plugin to version 4.5.15 or later on every WordPress site where it is installed.
Audit the Groundhogg contact activity data store and purge any entries containing HTML or scripting payloads in the path field.
Rotate administrator credentials and invalidate active sessions if evidence of exploitation is identified.

Patch Information

The vendor released a fix in Groundhogg 4.5.15. The patch adds escHTML() escaping to the activity.data.path value in both assets/js/admin/contacts/contact-editor.js and the minified build. Review the GitHub commit reference, the patched contact editor script, and the Wordfence vulnerability report for implementation details.

Workarounds

Deploy a Web Application Firewall rule that strips or blocks HTML metacharacters in the ref query parameter on tracked endpoints.
Restrict access to the Groundhogg contact editor view to a limited set of administrator accounts until patching is complete.
Enforce a strict Content-Security-Policy header in the WordPress admin area to limit inline script execution.

bash

# Update Groundhogg to the patched release using WP-CLI
wp plugin update groundhogg --version=4.5.15
wp plugin list --name=groundhogg --fields=name,version,status