PT-2025-14086 · WordPress · Groundhogg

Cristian Bejan

·

Published

2025-04-01

·

Updated

2025-04-01

·

CVE-2025-1267

CVSS v3.1

5.5

Medium

VectorAV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions Groundhogg plugin for Wordpress versions up to, and including, 3.7.4.1
Description The issue is related to Stored Cross-Site Scripting via the label parameter due to insufficient input sanitization and output escaping. This allows authenticated attackers with Administrator-level access to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The issue only affects multi-site installations and installations where unfiltered html has been disabled.
Recommendations For versions up to, and including, 3.7.4.1, consider disabling the label parameter to prevent exploitation until a patch is available. Restrict access to Administrator-level accounts to minimize the risk of injection. Avoid using the label parameter in affected pages until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-1267

Affected Products

Groundhogg