Groundhogg vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Groundhogg products: 5 record(s), with severity, exploitation and fixes.

Groundhogg 3 HollerBox 2

Exploited only (KEV) →

CVE-2026-106603 Medium · 6.5 CWE-639 Oct 8, 2026

WordPress HollerBox plugin <= 2.3.14 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in Groundhogg HollerBox holler-box allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HollerBox: from n/a through 2.3.14.

CVE-2026-104408 High · 7.6 CWE-89 Oct 5, 2026

WordPress Groundhogg plugin <= 4.8.3 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Groundhogg Groundhogg groundhogg allows Blind SQL Injection.This issue affects Groundhogg: from n/a through 4.8.3.

CVE-2026-48885 High · 7.1 CWE-79 Jun 15, 2026

WordPress HollerBox plugin <= 2.3.10.1 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in HollerBox <= 2.3.10.1 versions.

CVE-2026-40793 Medium · 6.5 CWE-862 Jun 15, 2026

WordPress Groundhogg plugin < 4.4.1 - Broken Access Control vulnerability

Subscriber Broken Access Control in Groundhogg < 4.4.1 versions.

CVE-2026-40727 High · 7.7 CWE-22 Jun 15, 2026

WordPress Groundhogg plugin <= 4.4 - Arbitrary File Deletion vulnerability

Sales Representative Arbitrary File Deletion in Groundhogg <= 4.4 versions.