EUVD-2026-19994
GHSA-m698-rpjv-64j7
Severity by source
AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
Primary rating from Vendor (wordfence) · only source for this CVE.
CVSS VectorVendor: wordfence
Lifecycle Timeline
3DescriptionCVE.org
The Gravity Forms plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the form_ids parameter in the gform_get_config AJAX action in all versions up to, and including, 2.9.30. This is due to the GFCommon::send_json() method outputting JSON-encoded data wrapped in HTML comment delimiters using echo and wp_die(), which serves the response with a Content-Type: text/html header instead of application/json. The wp_json_encode() function does not HTML-encode angle brackets within JSON string values, allowing injected HTML/script tags in form_ids array values to be parsed and executed by the browser. The required config_nonce is generated with wp_create_nonce('gform_config_ajax') and is publicly embedded on every page that renders a Gravity Forms form, making it identical for all unauthenticated visitors within the same 12-hour nonce tick. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This vulnerability cannot be exploited against users who are authenticated on the target system, but could be used to alter the target page.
AnalysisAI
Reflected cross-site scripting in Gravity Forms plugin for WordPress versions up to 2.9.30 allows unauthenticated attackers to inject arbitrary web scripts via the form_ids parameter in the gform_get_config AJAX action. The vulnerability exploits improper JSON encoding combined with HTML content-type headers and publicly reusable nonces; attackers can craft malicious links that, when clicked by users, execute injected scripts on vulnerable pages. No active exploitation confirmed; CVSS 4.7 reflects moderate risk constrained by required user interaction and limited scope.
Technical ContextAI
The Gravity Forms plugin's GFCommon::send_json() method outputs JSON-encoded data wrapped in HTML comment delimiters using echo and wp_die() with Content-Type: text/html instead of application/json. WordPress's wp_json_encode() function does not HTML-encode angle brackets within JSON string values, allowing injected HTML and script tags in the form_ids array to be parsed and executed by the browser. The vulnerability chain relies on the config_nonce parameter, generated via wp_create_nonce('gform_config_ajax'), which remains identical for all unauthenticated visitors within the same 12-hour nonce tick and is publicly embedded on every page rendering Gravity Forms forms. CWE-79 classifies this as improper neutralization of input during web page generation (cross-site scripting), rooted in the mismatch between JSON encoding logic and HTML rendering context.
RemediationAI
Upgrade Gravity Forms plugin to version 2.9.31 or later, which addresses the JSON encoding and content-type handling issues in the gform_get_config AJAX action. No workarounds are documented in the provided references. Administrators should review the official Gravity Forms changelog at https://docs.gravityforms.com/gravityforms-change-log/ and the plugin repository at https://plugins.trac.wordpress.org/browser/gravityforms/trunk/ to confirm patched version availability and apply the update immediately to all WordPress installations. If immediate patching is not feasible, consider disabling Gravity Forms temporarily or restricting access to affected pages via Web Application Firewall rules blocking requests with suspicious form_ids parameters.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today