CVE-2026-5113
HighSummary
The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via Consent field hidden inputs in versions up to 2.10.0. The issue arises from a flawed state validation mechanism that improperly sanitizes input.
Risk Assessment
Attackers can inject malicious scripts that will execute when administrators access the entries list. This poses a significant threat to data security and system integrity.
Recommendation
It is recommended to update the Gravity Forms plugin to the latest version to mitigate this vulnerability. Additionally, conducting a security audit to identify potential threats is advisable.
Other vulnerabilities in Gravity Forms plugin for WordPress
See all- CVE-2026-5112High
The Gravity Forms plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting in versions up to 2.10.0. The issue arises from insufficient input validation and output escaping of product names in Repeater fields.
- CVE-2026-5111High
The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 2.10.0. The issue arises from insufficient input validation and output escaping on Hidden Product field values, allowing unauthenticated attackers to inject scripts.
- CVE-2026-5110High
The Gravity Forms plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting in versions up to 2.10.0. This is due to insufficient input validation and output escaping in the SingleProduct field when used inside a Repeater field.
- CVE-2026-5109High
The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 2.10.0. This is due to insufficient validation and output escaping of Product Option field values, allowing raw unsanitized data to be stored in the database.
Original NVD description (English source)
The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Consent field hidden inputs in versions up to and including 2.10.0. This is due to a flawed state validation mechanism that fails open when input is sanitized by wp_kses(), combined with insufficient output escaping. The state validation logic creates two hashes (raw input and wp_kses-sanitized input) and only fails validation if BOTH hashes don't match the original state. When an attacker injects XSS payloads using tags stripped by wp_kses() (like <svg>), the sanitized hash matches while the malicious raw value is preserved and saved to the database. When administrators view the Entries List page, the stored malicious consent label is retrieved and output without escaping, causing the XSS payload to execute. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in entries that will execute whenever an authenticated administrator accesses the entries list page.