The Groundhogg WordPress plugin, versions up to and including 3.7.4.1, contains a stored cross‑site scripting flaw when the ‘label’ parameter is used. The flaw arises from inadequate input sanitization and output escaping, allowing an attacker who has Administrator privileges to inject arbitrary JavaScript into pages that are viewed by any user. This can lead to session hijacking, credential theft, or other malicious actions on pages rendered by the site.

Affected installations are those using the Groundhogg plugin version 3.7.4.1 or older on a WordPress multiserver environment where the ‘unfiltered_html’ capability is disabled. The vulnerability is tied to the plugin’s form builder functionality and is relevant to users operating under the trainingbusinesspros Groundhogg line of software.

The CVSS score of 5.5 indicates a medium severity vulnerability, while the EPSS score of less than 1% suggests a very low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Attackers must first authenticate with an account that has Administrator level permission and then craft a malicious payload in the ‘label’ field. Once injected, the script will execute for all subsequent visitors to the affected pages. Because the flaw only affects multiserver setups with unfiltered_html disabled, the attack surface is limited but still significant for sites that rely on the multi‑site feature.