Groundhogg WordPress Plugin CVE-2026-81660

Exploitation requires the Groundhogg plugin to be installed, active, and at a version prior to 4.5.13 on the target WordPress site, with at least one publicly accessible web form exposing the optional fields that lack server-side escaping. No authentication is required to submit the malicious payload (PR:N per CVSS vector). Achieving impact additionally requires a privileged WordPress user with access to the Groundhogg administrative form submissions view to actively navigate to that page after submission, triggering the stored script (UI:R per CVSS vector). Sites that do not expose Groundhogg web forms to the public, or that have the form feature disabled, are not exploitable at the injection stage. The required admin-interaction step limits fully automated end-to-end exploitation and materially distinguishes this from zero-interaction network vulnerabilities despite the PR:N initial access.

The CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects the near-zero attacker friction and high potential impact reasonably, though the S:U assignment may understate the true severity - stored XSS that executes inside a privileged admin session crosses a meaningful authorization boundary that many frameworks would score as S:C, which would push the score above 9.0. The low EPSS score of 0.17% (7th percentile) is notably inconsistent with both the high CVSS and confirmed public POC availability, suggesting that the UI:R dependency materially suppresses automated exploitation feasibility in observed telemetry. No CISA KEV listing exists, confirming no widespread active exploitation is confirmed at time of analysis. The attack cost is near-zero for the injection step - any anonymous visitor can submit a web form - while the payoff (admin session compromise) is high-value, meaning even deployments with modest traffic warrant treating this as a priority patch rather than deferring based on EPSS alone. The SSVC technical impact is total, but end-to-end automation is constrained by the required admin-view interaction, which meaningfully differentiates this from fully hands-off vulnerabilities.

An unauthenticated attacker locates a WordPress site running Groundhogg before 4.5.13 and submits a web form with a JavaScript payload - such as a cookie-exfiltration or rogue-admin-creation script - embedded in an optional field that the plugin stores without escaping; a public proof-of-concept demonstrates this technique. The payload persists in the WordPress database alongside legitimate submissions. When a WordPress administrator subsequently navigates to the Groundhogg form submissions view in the admin panel, the stored script executes in their browser, enabling the attacker to steal the session cookie or silently escalate to a persistent admin account.