The vulnerability is a Stored XSS triggered by the 'ref' parameter in the Groundhogg WordPress plugin. Insufficient sanitization and lack of escaping allow an attacker to embed malicious scripts that are stored and served to all users who view the affected page. This can lead to cross‑site data theft, session hijacking, or malicious actions performed on behalf of legitimate users.

Groundhogg – CRM, Newsletters, and Marketing Automation plugin for WordPress, version 4.5.14 and earlier, provided by trainingbusinesspros. Users running any of these releases should update to version 4.5.15 or later.

With a CVSS score of 7.2 the vulnerability is considered high severity. The EPSS score is not available, and the CVE is not listed in the CISA KEV catalog, yet the flaw is exploitable by unauthenticated actors. An attacker can send a crafted request with a malicious 'ref' value that is stored and executed whenever an authenticated user views the affected page. Because the parameter lacks access controls, any visitor could initiate the injection, making the risk widespread.