The Groundhogg plugin for WordPress contains a stored XSS flaw where unsanitized input can be rendered into web pages, potentially allowing an attacker to execute JavaScript in the context of a victim’s browser. This weak input validation, identified as CWE-79, can compromise user sessions, deface pages, or steal authentication cookies. Anyone who visits affected content could be abused by malicious actors.

Groundhogg plugin by Adrian Tobey installed on WordPress sites; all releases up to and including version 4.2.6 are vulnerable. No specific version numbers beyond the 4.2.6 cutoff are provided.

The CVSS score of 6.5 indicates moderate severity, while the EPSS of less than 1% suggests that exploitation is unlikely at present. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to supply malicious input that is stored by the plugin and later rendered to users; the flaw is a stored XSS that can affect any visitor to the affected content.