EUVD-2026-19990
GHSA-5pv5-mj98-fr8x
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Primary rating from Vendor (wordfence) · only source for this CVE.
CVSS VectorVendor: wordfence
Lifecycle Timeline
3DescriptionCVE.org
The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Credit Card field's 'Card Type' sub-field (input_<id>.4) in all versions up to, and including, 2.9.30. This is due to the get_value_entry_detail() method in the GF_Field_CreditCard class outputting the card type value without escaping, combined with get_value_save_entry() accepting and storing unsanitized user input for the input_<id>.4 parameter. The Card Type field is not rendered on the frontend form (it is normally derived from the card number), but the backend submission parser blindly accepts it if included in the POST request. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute when an administrator views the form entry in the WordPress dashboard.
AnalysisAI
Stored cross-site scripting in Gravity Forms plugin for WordPress up to version 2.9.30 allows unauthenticated attackers to inject malicious scripts via the Credit Card field's 'Card Type' sub-field. The vulnerability exploits a gap between frontend validation (Card Type is auto-derived from card number) and backend acceptance of unsanitized POST parameters, combined with unescaped output when administrators view form entries in the WordPress dashboard. Attackers can craft POST requests containing malicious JavaScript in the input_<id>.4 parameter, which is stored and executed with administrator privileges upon dashboard access.
Technical ContextAI
The vulnerability resides in the GF_Field_CreditCard class within the Gravity Forms WordPress plugin. The root cause involves two distinct code paths: the get_value_save_entry() method accepts and stores unsanitized user input from the input_<id>.4 POST parameter without validation or sanitization, while the get_value_entry_detail() method retrieves and outputs this stored value in the WordPress admin dashboard without HTML escaping (CWE-79: Improper Neutralization of Input During Web Page Generation). The Card Type field is intended to be automatically determined from the card number on the frontend, creating an information asymmetry where the backend accepts data the frontend never intended to collect. The Wordfence intelligence references point to specific unescaped output at line 516 and unsanitized input acceptance at line 577 in the class-gf-field-creditcard.php file, confirming the dual-vulnerability pattern (improper input validation combined with improper output encoding).
RemediationAI
Update Gravity Forms plugin to a patched version released after 2.9.30. Administrators should check the official Gravity Forms change log at https://docs.gravityforms.com/gravityforms-change-log/ for the first patched release and upgrade immediately. The fix requires both sanitization of the input_<id>.4 POST parameter in get_value_save_entry() and HTML escaping of the card type value in get_value_entry_detail(). As an interim mitigation while waiting for updates, restrict WordPress dashboard access to trusted administrators only, and consider disabling the Credit Card field if not in active use. WordPress site administrators should enable automatic plugin updates if feasible, and monitor the Wordfence vulnerability intelligence feed for confirmation of patch availability.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today