CVE-2026-5109
Stored XSS in Gravity Forms WordPress Plugin
Publication date: 2026-05-02
Last updated on: 2026-05-05
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| rocketgenius | gravity_forms | to 2.10.0 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The Gravity Forms plugin for WordPress up to version 2.10.0 has a Stored Cross-Site Scripting (XSS) vulnerability. This occurs because the plugin does not properly validate and escape Product Option field values before storing them. Specifically, the state validation function accepts submitted values if their sanitized version matches a legitimate option, but it stores the raw, unsanitized value in the database. When an administrator views entry details in the Order Summary section, the plugin outputs this unsanitized value directly without escaping, allowing any injected JavaScript to execute.
This means an unauthenticated attacker can inject malicious scripts into entry data, which will run whenever an administrator accesses the affected entry details page.
How can this vulnerability impact me? :
This vulnerability can allow unauthenticated attackers to execute arbitrary JavaScript code in the context of an administrator's browser when they view entry details. This can lead to several impacts including theft of administrator session cookies, unauthorized actions performed on behalf of the administrator, defacement, or further compromise of the WordPress site.
Because the vulnerability requires no authentication and has a CVSS base score of 7.2, it represents a significant security risk.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows unauthenticated attackers to inject arbitrary web scripts that execute when administrators view entry details. This can lead to unauthorized access or manipulation of sensitive data stored in Gravity Forms entries.
Such unauthorized script execution and potential data exposure could impact compliance with data protection regulations like GDPR and HIPAA, which require safeguarding personal and sensitive information against unauthorized access and ensuring data integrity.
However, the provided context does not explicitly discuss compliance implications or specific regulatory impacts.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability exists in Gravity Forms plugin versions up to and including 2.10.0. To mitigate this vulnerability, you should update the Gravity Forms plugin to a version later than 2.10.0 where this issue is fixed.
Since the vulnerability allows unauthenticated attackers to inject malicious scripts via Product Option field values, immediate mitigation includes restricting access to the WordPress admin area and monitoring for suspicious entries in the Order Summary section.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves stored Cross-Site Scripting (XSS) in the Gravity Forms plugin for WordPress, specifically in the Product Option field values that are insufficiently validated and escaped.
Detection typically involves inspecting the database entries for Gravity Forms submissions to identify any injected JavaScript payloads in the Product Option fields.
Since the vulnerability triggers when administrators view entry details in the Order Summary section, monitoring HTTP responses for unexpected script tags or suspicious content in these pages can help detect exploitation.
- Manually review Gravity Forms entries in the WordPress admin panel, especially the Order Summary section, for suspicious or unexpected HTML/JavaScript code.
- Use database queries to search for suspicious script tags or common XSS payload patterns in the Gravity Forms entries table (usually wp_gf_entry or similar). For example, a MySQL command might be:
SELECT * FROM wp_gf_entry WHERE value LIKE '%<script>%';
- Use web vulnerability scanners or XSS detection tools targeting WordPress Gravity Forms plugin entry points.
- Monitor web server logs for unusual requests that might include script injection attempts targeting Gravity Forms submission endpoints.