Executive Summary

The Gravity Forms plugin for WordPress has a Reflected Cross-Site Scripting (XSS) vulnerability via the `form_ids` parameter in the `gform_get_config` AJAX action in all versions up to and including 2.9.30.

This happens because the method `GFCommon::send_json()` outputs JSON-encoded data wrapped in HTML comment delimiters using `echo` and `wp_die()`, serving the response with a `Content-Type: text/html` header instead of `application/json`.

The `wp_json_encode()` function does not HTML-encode angle brackets within JSON string values, which allows injected HTML or script tags in the `form_ids` array values to be parsed and executed by the browser.

Although a `config_nonce` is required and generated with `wp_create_nonce('gform_config_ajax')`, it is publicly embedded on every page rendering a Gravity Forms form and is identical for all unauthenticated visitors within the same 12-hour nonce tick.

This makes it possible for unauthenticated attackers to inject arbitrary web scripts into pages that execute if a user is tricked into performing an action like clicking a link.

The vulnerability cannot be exploited against authenticated users on the target system but could be used to alter the target page.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows unauthenticated attackers to inject and execute arbitrary scripts in the context of the affected website.

If a user is tricked into clicking a malicious link, the injected scripts could run in their browser, potentially leading to actions such as stealing session information, redirecting users to malicious sites, or altering the content of the affected page.

However, the vulnerability cannot be exploited against authenticated users, which limits some attack scenarios.

The overall impact is a moderate risk of information disclosure and integrity loss of the web page content.

Useful 0 Not Useful 0