CVE-2026-5112
Unauthenticated Stored XSS in Gravity Forms WordPress Plugin
Publication date: 2026-05-02
Last updated on: 2026-05-05
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| rocketgenius | gravity_forms | to 2.10.0 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The Gravity Forms plugin for WordPress has a vulnerability called Unauthenticated Stored Cross-Site Scripting (XSS) in versions up to and including 2.10.0. This happens because the plugin does not properly validate or escape input in the Calculation Product field product names when used inside Repeater fields.
Specifically, the validate() method in the GF_Field_Calculation class only checks the quantity field and ignores the product name field, allowing malicious HTML code to pass through. When the form entry is saved, the raw value is stored without sanitization. Later, when an administrator views the entry in the WordPress admin area, the malicious script is rendered and executed because the output is not escaped.
This means an unauthenticated attacker can inject harmful scripts via form submissions that will run in the browser of any authenticated administrator who views the entry details.
How can this vulnerability impact me? :
This vulnerability can allow an unauthenticated attacker to execute arbitrary scripts in the context of an authenticated administrator's browser. This can lead to several impacts including:
- Theft of administrator session cookies or credentials.
- Unauthorized actions performed on behalf of the administrator.
- Potential compromise of the WordPress site’s administrative functions.
- Injection of malicious content or redirection to malicious sites.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves unauthenticated stored cross-site scripting in the Gravity Forms WordPress plugin versions up to 2.10.0, specifically related to the Calculation Product field product names in Repeater fields.
Detection would involve identifying if the vulnerable plugin version is installed and checking for suspicious or malicious HTML/script content in form submissions, especially in Calculation Product field product names.
Since the vulnerability triggers when an authenticated administrator views entry details, monitoring or scanning form entries for injected scripts could help detect exploitation.
No specific commands or automated detection scripts are provided in the available resources.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include updating the Gravity Forms plugin to a version later than 2.10.0 where this vulnerability is fixed.
If an update is not immediately possible, restrict access to the WordPress admin area, especially limiting users with the gravityforms_view_entries capability.
Additionally, review and sanitize existing form entries to remove any malicious scripts injected via the Calculation Product field.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows unauthenticated attackers to inject arbitrary web scripts that execute when an authenticated administrator views form entries. This could lead to unauthorized access or manipulation of sensitive data within the WordPress admin interface.
Such unauthorized script execution and potential data exposure may impact compliance with standards and regulations like GDPR and HIPAA, which require protection of personal and sensitive data against unauthorized access and breaches.
However, the provided context does not explicitly detail the compliance implications or specific regulatory impacts of this vulnerability.