CVE-2026-81741
UNKNOWN
NVD
CVSS Score
0
Severity
UNKNOWN
Published
Sep 09, 2026
Vendor
unknown
Description
The Groundhogg — CRM, Newsletters, and Marketing Automation WordPress plugin before 4.7.2 does not restrict the redirect target of its email preference confirmation flow to the site's own host, allowing unauthenticated attackers to redirect visitors to an arbitrary external URL by way of a crafted link.