Groundhogg — CRM, Newsletters, and Marketing Automation

77 Quality Score

Active Installs

15/30

With only 2,000 active installs, Groundhogg has a very small user base compared to alternatives like MailPoet or Newsletter, which limits community resources and third-party tutorials.

Update Freshness

25/25

The plugin was updated in July 2026 and shows a perfect maintenance score, indicating the developer is actively shipping fixes and improvements.

User Rating

15/15

A 98 out of 100 rating from 146 reviewers is excellent, though the smaller sample size makes it less statistically reliable than top alternatives with thousands of reviews.

Support Health

8/15

There are zero public support threads and zero resolved, which is a notable concern since it suggests either very few users need help or that support happens exclusively through paid channels and documentation.

WP Compatibility

15/15

The plugin supports WordPress 7.0.1 and requires PHP 7.1, which is reasonable, but its minimal install count means fewer real-world compatibility tests across diverse hosting environments.

Scores higher than 55% of indexed plugins

About

Groundhogg is the best WordPress CRM & Marketing Automation plugin. Create flows, email campaigns, and have a CRM all within your WordPress site.

Active Installs 2k+

Rating ★★★★½ 4.9/5

Last Updated 2026-09-18 5:13pm GMT

Requires WordPress 6.9+

Tested Up To 7.1.1

Requires PHP 7.4+

Security History

36 known vulnerabilities, all patched

12 High 24 Medium

Most recent: September 9, 2026

View details ▸

Groundhogg — CRM, Newsletters, and Marketing Automation <= 4.7.1 - Authenticated (Import_contacts+) Path Traversal Medium

September 9, 2026 Patched in ["4.7.2"] CVE-2026-85310

Groundhogg — CRM, Newsletters, and Marketing Automation < 4.7.2 - Unauthenticated Open Redirect Medium

September 7, 2026 Patched in ["4.7.2"] CVE-2026-81741

Groundhogg — CRM, Newsletters, and Marketing Automation < 4.5.13 - Unauthenticated Stored Cross-Site Scripting High

August 31, 2026 Patched in ["4.5.13"] CVE-2026-81660

Groundhogg <= 4.5.14 - Authenticated (Vendor+) SQL Injection via 'tag_query' Parameter Medium

August 14, 2026 Patched in ["4.5.15"] CVE-2026-18387

Groundhogg — CRM, Newsletters, and Marketing Automation <= 4.5.2 - Insecure Direct Object Reference Medium

August 4, 2026 Patched in ["4.5.3"] CVE-2026-11454

Groundhogg — CRM, Newsletters, and Marketing Automation <= 4.4.1 - Authenticated (Sales Representative+) Arbitrary File Deletion High

July 8, 2026 Patched in ["4.5"] CVE-2026-57389

Groundhogg <= 4.5.8 - Authenticated (Custom+) SQL Injection via 'select' Parameter Medium

July 1, 2026 Patched in ["4.5.9"] CVE-2026-14029

Groundhogg <= 4.5.5 - Authenticated (Sales Rep+) SQL Injection via 'query[select]' Parameter Medium

June 26, 2026 Patched in ["4.5.6"] CVE-2026-13333

Groundhogg <= 4.5.5 - Authenticated (Marketer+) SQL Injection via 'search' Parameter Medium

June 26, 2026 Patched in ["4.5.6"] CVE-2026-13331

Groundhogg — CRM, Newsletters, and Marketing Automation <= 4.5 - Authenticated (Sales representative+) SQL Injection Medium

June 26, 2026 Patched in ["4.5.1"] CVE-2026-57667

Groundhogg <= 4.5.4 - Authenticated (Custom+) SQL Injection via 'after' Parameter Medium

June 25, 2026 Patched in ["4.5.5"] CVE-2026-13226

Groundhogg — CRM, Newsletters, and Marketing Automation < 4.4.1 - Missing Authorization Medium

April 24, 2026 Patched in ["4.4.1"] CVE-2026-40793

Groundhogg — CRM, Newsletters, and Marketing Automation <= 4.4 - Authenticated (Sales Representative+) Arbitrary File Deletion High

April 16, 2026 Patched in ["4.4.1"] CVE-2026-40727

Groundhogg <= 4.2.6.1 - Authenticated (Admin+) SQL Injection Medium

November 20, 2025 Patched in ["4.2.7"] CVE-2025-12750

Groundhogg <= 4.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting Medium

October 31, 2025 Patched in ["4.2.6.1"] CVE-2025-64367

Groundhogg <= 4.2.2 - Authenticated (Sales Representative+) PHP Object Injection High

August 5, 2025 Patched in ["4.2.2.1"] CVE-2025-54053

Groundhogg <= 4.2.1 - Authenticated (Sales Rep+) Arbitrary File Upload High

July 4, 2025 Patched in ["4.2.2"] CVE-2025-48300

WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg <= 4.1.1.2 - Authenticated (Administrator+) Arbitrary File Deletion High

May 8, 2025 Patched in ["4.1.2"] CVE-2025-4206

Groundhogg <= 3.7.4.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via label Parameter Medium

March 31, 2025 Patched in ["4.0"] CVE-2025-1267

Groundhogg <= 3.7.3.5 - Authenticated (Author+) Arbitrary File Upload via gh_big_file_upload Function High

January 13, 2025 Patched in ["3.7.3.6"] CVE-2025-0394

Groundhogg <= 3.7.3.3 - Reflected Cross-Site Scripting Medium

January 3, 2025 Patched in ["3.7.3.4"] CVE-2024-56289

Groundhogg <= 3.4.2.3 - Reflected Cross-Site Scripting Medium

June 27, 2024 Patched in ["3.4.3"] CVE-2024-37264

Groundhogg <= 3.4.2.3 - Cross-Site Request Forgery Medium

June 21, 2024 Patched in ["3.4.3"] CVE-2024-37235

Groundhogg <= 2.7.11.10 - Authenticated (Administrator+) Stored Cross-Site Scripting via Task Data Medium

October 25, 2023 Patched in ["2.7.11.11"] CVE-2023-40681

Groundhogg <= 2.7.11 - Cross-Site Request Forgery Medium

May 30, 2023 Patched in ["2.7.11.1"] CVE-2023-34178

Groundhogg <= 2.7.11 - Authenticated (Administrator+) SQL Injection High

May 30, 2023 Patched in ["2.7.11.1"] CVE-2023-34179

Groundhogg <= 2.7.9.8 - Missing Authorization to Admin Account and Ticket Creation Medium

May 19, 2023 Patched in ["2.7.10"] CVE-2023-2715

Groundhogg <= 2.7.9.8 - Missing Authorization to Update License Medium

May 19, 2023 Patched in ["2.7.10"] CVE-2023-2714

Groundhogg <= 2.7.9.8 - Missing Authorization to Non-Arbitrary File Upload Medium

May 19, 2023 Patched in ["2.7.10"] CVE-2023-2716

Groundhogg <= 2.7.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Medium

May 19, 2023 Patched in ["2.7.10"] CVE-2023-2735

Groundhogg <= 2.7.9.8 - Cross-Site Request Forgery to Privilege Escalation High

May 19, 2023 Patched in ["2.7.10"] CVE-2023-2736

Groundhogg <= 2.7.9.8 - Cross-Site Request Forgery to Disable All Plugins Medium

May 19, 2023 Patched in ["2.7.10"] CVE-2023-2717

Groundhogg <= 2.7.9.3 - Authenticated (Administrator)+ SQL Injection High

March 20, 2023 Patched in ["2.7.9.4"] CVE-2023-1425

Groundhogg <= 1.3.11.13 - SQL Injection High

October 23, 2019 Patched in ["2.0.8"]

Groundhogg <= 2.0.8.1 - Reflected Cross-Site Scripting Medium

September 10, 2019 Patched in ["2.0.9.11"]

WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg < 1.3.5 - Remote Code Execution High

April 8, 2019 Patched in ["1.3.5"] CVE-2019-15647

What It Does

Groundhogg turns a WordPress site into a self-contained CRM and marketing automation hub, letting you manage contacts, build email campaigns, and create automated workflows without sending data to a third-party platform. It combines contact management, email broadcasts, and behavioural trigger sequences in a single plugin dashboard. Essentially, it aims to replace external tools like HubSpot or ActiveCampaign for small businesses that prefer to keep everything inside WordPress.

Who It's For

This plugin fits small businesses, consultants, and WooCommerce store owners who want full ownership of their contact data and are comfortable managing it inside WordPress rather than through a hosted SaaS solution. It is best suited to technically capable site owners who can handle their own email deliverability and server configuration. Marketing teams looking to deeply integrate CRM data with their existing WordPress content and forms will get the most value.

Who Should Skip It

If you are not comfortable with server-side email deliverability, DNS records, and WordPress hosting performance tuning, you should skip this plugin and use a managed email service instead. Casual bloggers or single-product shops under 500 contacts will find it heavier than necessary.

The Bottom Line

Groundhogg delivers a powerful self-hosted CRM and automation suite backed by a near-perfect user rating and clearly active development, making it a strong choice for privacy-focused small businesses that want full data ownership. However, the tiny install base, lack of public support activity, and server-side email deliverability requirements mean it is not a beginner-friendly option. If you are comfortable managing your own infrastructure and want WordPress-native CRM control, it is worth testing on a staging site first.

Pick Hostinger Reach if you are a Hostinger customer who wants a fully managed, AI-assisted email marketing tool with a million other users and minimal setup.

MailPoet – Newsletters, Email Marketing, and Automation 89/100

Pick MailPoet if you want newsletters and basic automation with massive community support, deeper WooCommerce integration, and 500,000 active installs proving stability.

Flamingo 87/100

Pick Flamingo as a lightweight companion to Contact Form 7 if you only need to store contact form submissions, not run a full CRM or automation engine.

Newsletter – Send awesome emails from WordPress 85/100

Pick Newsletter if you want a simpler, more proven newsletter-only solution with 200,000 installs and less operational overhead than a full CRM.

Newsletters, Email Marketing, SMS and Popups by Omnisend 84/100

Pick Omnisend if you need ecommerce-focused email and SMS marketing with a hosted delivery infrastructure, rather than running it all from your own server.