Groundhogg EUVD-2026-101843

Exploitation requires that Groundhogg's link/visit activity tracking be in use so that an attacker-supplied 'ref' path value gets stored against a contact, and then requires a logged-in Groundhogg user/administrator to open that contact's record and view its activity timeline in the wp-admin contact editor, where the stored path is rendered without escaping (fixed by escHTML() in 4.5.15). The injection itself needs no authentication, but the payload only executes in the browser of the staff member who later views the affected contact - so the practical limiting factors are (1) the site actively using contact/activity tracking and (2) an operator viewing the malicious contact; it does not fire against anonymous front-end visitors.

This is a moderate-priority issue rather than a top-tier emergency. The Wordfence-assigned CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, 7.2 High) describes network-reachable, low-complexity, unauthenticated injection with a scope change and Low confidentiality/integrity impact - consistent with a stored XSS that fires in an administrator's browser session. No EPSS score, no CISA KEV listing, and no public POC were supplied, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the risk is theoretical-but-credible, not observed. Note a signal conflict: the vector asserts UI:N, yet the description states the script 'executes whenever a user accesses an injected page,' which implies a victim (most plausibly a logged-in Groundhogg operator viewing a contact's activity timeline) must open the affected view - so real-world triggering does require victim action even though UI:N suggests otherwise; verify the interaction model with the vendor. The source commit shows the unescaped sink is the contact-editor activity path rendered in wp-admin, meaning successful exploitation lands in an authenticated admin context and could realistically be chained to session/nonce theft or rogue-admin creation, which would push practical integrity impact above the Low rating assigned. A fix exists (4.5.15), which lowers urgency for patched sites.

An unauthenticated attacker crafts a malicious 'ref' value (a tracked link/visit path) containing a script payload, which Groundhogg stores as contact activity data. Later, when a logged-in administrator or operator opens that contact's activity timeline in the WordPress admin contact editor, the unescaped path is rendered and the injected script executes in the admin's authenticated browser session. No public exploit code was identified in the provided data, but the patch commit (escHTML added in 4.5.15) confirms the vulnerable sink.