CVE-2025-1267

The Groundhogg plugin for Wordpress is vulnerable to Stored Cross-Site Scripting via the ‘label' parameter in versions up to, and including, 3.7.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

• CWE-79

• https://github.com/groundhoggwp/groundhogg/commit/5206bf2482e2fe210ccca6e7dcfe62ffe85b3061
• https://plugins.trac.wordpress.org/browser/groundhogg/trunk/assets/js/admin/forms/form-builder-v2.js
• https://plugins.trac.wordpress.org/browser/groundhogg/trunk/assets/js/admin/forms/form-builder-v2.js#L859
• https://plugins.trac.wordpress.org/changeset/3264477/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/763a9aff-9bc0-4c79-9383-778a9034b436?source=cve

Published

Apr 1, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-12664GitLab has remediated an issue in GitLab CE/EE affecting all…7.5
• CVE-2025-12665The Ninja Countdown | Fastest Countdown Builder plugin for W…4.3
• CVE-2025-12666The Google Drive upload and download link plugin for WordPre…6.4
• CVE-2025-12667The GitHub Gist Shortcode Plugin for WordPress is vulnerable…6.4
• CVE-2025-12668The WP Count Down Timer plugin for WordPress is vulnerable t…6.4
• CVE-2025-12669GitLab has remediated an issue in GitLab CE/EE affecting all…5.4
• CVE-2025-12670The wp-twitpic plugin for WordPress is vulnerable to Stored …6.4
• CVE-2025-12671The WP-Iconics plugin for WordPress is vulnerable to Stored …6.4
• CVE-2025-12672The Flickr Show plugin for WordPress is vulnerable to Stored…6.4
• CVE-2025-12673The Flex QR Code Generator plugin for WordPress is vulnerabl…9.8
• CVE-2025-12674The KiotViet Sync plugin for WordPress is vulnerable to arbi…9.8
• CVE-2025-12675The KiotViet Sync plugin for WordPress is vulnerable to unau…4.3