Groundhogg WordPress Plugin Stored XSS via Unvalidated Form Fields

The Groundhogg — CRM, Newsletters, and Marketing Automation WordPress plugin before 4.5.13 does not validate or escape values submitted to some optional web form fields before storing them and outputting them back in an administrative area, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against high privilege users.

Casky was already ahead

This CVE exploits attack patterns that Casky's 323matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-81660 exposes a critical vulnerability in the Groundhogg WordPress CRM plugin where unauthenticated attackers can inject malicious scripts into optional web form fields. These payloads are stored in the database and executed when administrators access the plugin's administrative interface, creating a persistent threat to high-privilege users. With a CVSS score of 8.8, this Stored XSS vulnerability (CWE-79) affects any WordPress installation running Groundhogg before version 4.5.13. The attack requires no authentication, making it accessible to any user who can access the plugin's front-end forms, and the impact is amplified by targeting administrators who can modify site configurations, install plugins, or access sensitive data.

Casky's 323 mapped security skills leverage Claude's extended reasoning to detect the attack patterns underlying this vulnerability across the MITRE ATT&CK framework. For TA0001 (Initial Access), practitioners would identify suspicious form submissions containing script tags or HTML entities in optional fields—a hallmark of XSS reconnaissance. For TA0043 (Reconnaissance), the skills flag pattern analysis of how attackers test form validation by submitting benign payloads before escalating to malicious ones. Practitioners using Casky would receive findings highlighting unescaped output in admin templates, missing input sanitization functions, and stored payloads in database queries—enabling teams to prioritize patching, implement output encoding remediation, and deploy Web Application Firewalls (WAF) rules to block malicious form submissions before they reach vulnerable endpoints.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

323 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-81660.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-81660

Casky has 323 skills that investigate the attack patterns behind CVE-2026-81660. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn