Skip to content
PluginCanary

Groundhogg - CRM, Newsletters, and Marketing Automation

by Adrian Tobey · 2,000+ active installs · Checked 3 Nov 2026
Healthy11 Warnings

Healthy: vulnerability published 15 Oct 2026, fixed in 4.9.4.

81/ 100 Canary Score
Sub-scores for Groundhogg - CRM, Newsletters, and Marketing Automation
Ownership100
Maintenance100
Security60
Support70
Reputation70

How the score works

Active signals

Facts we detected, with links to the source.

  • WarningSEC-1Vulnerability published 15 Oct 2026, fixed in 4.9.4. Update to version 4.9.4 or later.15 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 14 Oct 2026, fixed in 4.5.15. Update to version 4.5.15 or later.14 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 9 Oct 2026, fixed in 4.9. Update to version 4.9 or later.9 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 9 Oct 2026, fixed in 4.9.1. Update to version 4.9.1 or later.9 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 5 Oct 2026, fixed in 4.9. Update to version 4.9 or later.5 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 5 Oct 2026, fixed in 4.9. Update to version 4.9 or later.5 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 2 Oct 2026, fixed in 4.9.1. Update to version 4.9.1 or later.2 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 9 Sep 2026, fixed in 4.7.2. Update to version 4.7.2 or later.9 Sep 2026Evidence
  • WarningSEC-1Vulnerability published 7 Sep 2026, fixed in 4.7.2. Update to version 4.7.2 or later.7 Sep 2026Evidence
  • WarningSEC-1Vulnerability published 31 Aug 2026, fixed in 4.5.13. Update to version 4.5.13 or later.31 Aug 2026Evidence
  • WarningSEC-1Vulnerability published 14 Aug 2026, fixed in 4.5.15. Update to version 4.5.15 or later.14 Aug 2026Evidence
  • InfoSEC-328 vulnerabilities published in the last 24 months. Review this plugin.4 Nov 2026Evidence

Ownership timeline

Who commits to the plugin's code on wordpress.org, over time.

Committers and their active periods
trainingbusinesspros1 Oct 2018 to 29 Oct 2026, 701 commits

1 committer recorded. No ownership changes recorded since 3 Nov 2026.

Maintenance

Last release
5 days ago
Releases, 24 months
87
Tested up to
7.1 current
Requires PHP
7.4 supported 8.2+
Releases per quarter for Groundhogg - CRM, Newsletters, and Marketing Automation
Q1 202412
Q2 202411
Q3 202413
Q4 20249
Q1 20255
Q2 202513
Q3 202515
Q4 20256
Q1 20266
Q2 202612
Q3 202617
Q4 20266

Last release 29 Oct 2026. Tested with WordPress 7.1 (current).

Support

100% of 1 support threads resolved in the last 2 months.

Security record

PublishedIssueCVSSAffectedFixed inDays to patch
15 Oct 2026Groundhogg <= 4.9.3 - Authenticated (Sales Representative+) Arbitrary File Deletion via CSV Import 'copy_file' Field Mapping8.1<= 4.9.34.9.40
14 Oct 2026Groundhogg <= 4.5.14 - Unauthenticated Stored Cross-Site Scripting via 'ref' Parameter7.2<= 4.5.144.5.150
9 Oct 2026Groundhogg <= 4.8.3 - Unauthenticated Privilege Escalation to Support User Identity Confusion8.1<= 4.8.34.90
9 Oct 2026Groundhogg <= 4.9 - Authenticated (Custom+) Privilege Escalation to 'user' Parameter8.8<= 4.94.9.10
5 Oct 2026Groundhogg — CRM, Newsletters, and Marketing Automation <= 4.8.3 - Unauthenticated Information Exposure5.3<= 4.8.34.90
5 Oct 2026Groundhogg — CRM, Newsletters, and Marketing Automation <= 4.8.3 - Authenticated (Custom Role+) SQL Injection6.5<= 4.8.34.90
2 Oct 2026Groundhogg <= 4.9 - Authenticated (Sales Person+) Privilege Escalation via Contact Identity Rebinding leading to Administrator Account Takeover to 'user_id' Parameter (v3 /contacts) chained with v4 /emails/test8.8<= 4.94.9.10
9 Sep 2026Groundhogg — CRM, Newsletters, and Marketing Automation <= 4.7.1 - Authenticated (Import_contacts+) Path Traversal6.5<= 4.7.14.7.20
7 Sep 2026Groundhogg — CRM, Newsletters, and Marketing Automation < 4.7.2 - Unauthenticated Open Redirect6.1< 4.7.24.7.20
31 Aug 2026Groundhogg — CRM, Newsletters, and Marketing Automation < 4.5.13 - Unauthenticated Stored Cross-Site Scripting7.2< 4.5.134.5.130
14 Aug 2026Groundhogg <= 4.5.14 - Authenticated (Vendor+) SQL Injection via 'tag_query' Parameter6.5<= 4.5.144.5.150
4 Aug 2026Groundhogg — CRM, Newsletters, and Marketing Automation <= 4.5.2 - Insecure Direct Object Reference6.5<= 4.5.24.5.30
8 Jul 2026Groundhogg — CRM, Newsletters, and Marketing Automation <= 4.4.1 - Authenticated (Sales Representative+) Arbitrary File Deletion8.1<= 4.4.14.50
1 Jul 2026Groundhogg <= 4.5.8 - Authenticated (Custom+) SQL Injection via 'select' Parameter6.5<= 4.5.84.5.90
26 Jun 2026Groundhogg <= 4.5.5 - Authenticated (Sales Rep+) SQL Injection via 'query[select]' Parameter6.5<= 4.5.54.5.60
26 Jun 2026Groundhogg — CRM, Newsletters, and Marketing Automation <= 4.5 - Authenticated (Sales representative+) SQL Injection6.5<= 4.54.5.10
26 Jun 2026Groundhogg <= 4.5.5 - Authenticated (Marketer+) SQL Injection via 'search' Parameter6.5<= 4.5.54.5.60
25 Jun 2026Groundhogg <= 4.5.4 - Authenticated (Custom+) SQL Injection via 'after' Parameter6.5<= 4.5.44.5.50
24 Apr 2026Groundhogg — CRM, Newsletters, and Marketing Automation < 4.4.1 - Missing Authorization4.3< 4.4.14.4.10
16 Apr 2026Groundhogg — CRM, Newsletters, and Marketing Automation <= 4.4 - Authenticated (Sales Representative+) Arbitrary File Deletion8.1<= 4.44.4.10
20 Nov 2025Groundhogg <= 4.2.6.1 - Authenticated (Admin+) SQL Injection4.9<= 4.2.6.14.2.70
31 Oct 2025Groundhogg <= 4.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4<= 4.2.64.2.6.10
5 Aug 2025Groundhogg <= 4.2.2 - Authenticated (Sales Representative+) PHP Object Injection7.5<= 4.2.24.2.2.10
4 Jul 2025Groundhogg <= 4.2.1 - Authenticated (Sales Rep+) Arbitrary File Upload8.8<= 4.2.14.2.20
8 May 2025WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg <= 4.1.1.2 - Authenticated (Administrator+) Arbitrary File Deletion7.2<= 4.1.1.24.1.20

Source: Wordfence Intelligence.

Reputation

Lifetime rating 4.8 from 150 ratings. Quarterly trends appear as new reviews arrive.

Rating distribution
5 star139
4 star5
3 star2
2 star2
1 star2

Momentum

2,000+ active installs. History builds with each weekly snapshot.

Weekly downloads, last 27 weeks
Weekly downloads for Groundhogg - CRM, Newsletters, and Marketing Automation
4 May 2026122
11 May 2026237
18 May 2026346
25 May 2026226
1 Jun 20262,099
8 Jun 20261,385
15 Jun 2026490
22 Jun 20262,267
29 Jun 20262,629
6 Jul 20263,177
13 Jul 2026848
20 Jul 20261,394
27 Jul 2026431
3 Aug 2026528
10 Aug 20261,403
17 Aug 20262,684
24 Aug 2026602
31 Aug 20261,378
7 Sep 2026620
14 Sep 20263,472
21 Sep 2026693
28 Sep 20262,045
5 Oct 20262,848
12 Oct 20262,212
19 Oct 2026712
26 Oct 20261,841
2 Nov 2026186

Weekly downloads over the last 4 weeks are 9% below the 27-week average.

Healthier alternatives

Same category, higher Canary Score. Never sponsored.

LeadinfoScore 90 · 7,000+ActiveCampaign for WooCommerceScore 89 · 5,000+WP Fusion Lite - Marketing Automation and CRM Integration for WordPressScore 89 · 4,000+FluentCRM - Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM SolutionScore 88 · 80,000+Jetpack CRM - Clients, Leads, Invoices, Billing, Email Marketing, & AutomationScore 87 · 30,000+

Facts

Version4.10
AuthorAdrian Tobey
Added1 Oct 2018
Last updated29 Oct 2026
Active installs2,000+
Requires WordPress6.9
Tested up to7.1.4
Requires PHP7.4
CategoryCustomer Management > CRM & Customer Database
Tagscrm, Wordpress CRM, Email Marketing, email automation, marketing automation

Other plugins by this author: HollerBox - Fast & Effective Popups & Lead-Generation, FormLift for Keap (Legacy) Web Forms, MailHawk - Simple SMTP, Email Delivery, and Email Logging, Auto Fill Form Fields, Live Chat for WordPress - WP Simple Chat - by Groundhogg, Infusionsoft Proxy Service

Questions

Is Groundhogg - CRM, Newsletters, and Marketing Automation still maintained?

Groundhogg - CRM, Newsletters, and Marketing Automation was last updated on 29 Oct 2026. Its Canary status is Healthy.

Is Groundhogg - CRM, Newsletters, and Marketing Automation safe?

Groundhogg - CRM, Newsletters, and Marketing Automation has no open unpatched vulnerabilities on record. 28 vulnerabilities were published in the last 24 months. Its Canary status is Healthy.

Who owns Groundhogg - CRM, Newsletters, and Marketing Automation?

The wordpress.org author is Adrian Tobey. Recent committers: trainingbusinesspros, plugin-master. We have recorded no ownership change.

What can I use instead of Groundhogg - CRM, Newsletters, and Marketing Automation?

Plugins in the same category with a higher Canary Score: Leadinfo, ActiveCampaign for WooCommerce, WP Fusion Lite - Marketing Automation and CRM Integration for WordPress, FluentCRM - Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution, Jetpack CRM - Clients, Leads, Invoices, Billing, Email Marketing, & Automation.

Data: wordpress.org Plugins API, plugins SVN and Trac, wordpress.org reviews, Wordfence Intelligence.Plugin data refreshed 3 Nov 2026.Report a data issue