What is the CVSS score of CVE-2026-5109?

CVE-2026-5109 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Gravity Forms are affected by CVE-2026-5109?

Gravity Forms for WordPress versions 2.10.0 and earlier contain a stored cross-site scripting (XSS) vulnerability that allows unauthenticated attackers to inject malicious JavaScript through product…

How to fix or mitigate CVE-2026-5109?

Within 24 hours: Identify all WordPress installations running Gravity Forms ≤2.10.0 using inventory or plugin audit tools. Within 7 days: Contact Gravity Forms support to confirm patch availability and expected release timeline; as interim mitigation, restrict form submissions from untrusted sources or disable Product Option fields pending patch release. Within 30 days: Deploy vendor patch immediately upon release, or implement Web Application Firewall (WAF) rules to block XSS patterns in form submissions if patch remains unavailable.

Gravity Forms CVE-2026-5109

EUVD-2026-26741 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-05-02 Wordfence

PHP WordPress XSS

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 02, 2026 - 06:31 vuln.today

EUVD ID Assigned

May 02, 2026 - 06:00 euvd

EUVD-2026-26741

Analysis Generated

May 02, 2026 - 06:00 vuln.today

CVE Published

May 02, 2026 - 05:29 nvd

HIGH 7.2

DescriptionCVE.org

The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 2.10.0. This is due to insufficient validation and output escaping of Product Option field values. The vulnerability exists because the state validation function accepts submitted values where the wp_kses()-sanitized version matches a legitimate option value, but then stores the raw unsanitized value in the database. When administrators view entry details via the Order Summary section, the option_label is output directly without escaping (view-order-summary.php line 32), executing the injected JavaScript. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in entry data that will execute whenever an administrator accesses the entry details page.

AnalysisAI

Stored XSS in Gravity Forms for WordPress ≤2.10.0 allows unauthenticated remote attackers to inject malicious JavaScript through Product Option field values that execute when administrators view entry details. The flaw exploits a sanitization bypass: the plugin's state validation accepts values matching wp_kses()-cleaned legitimate options but stores the raw unsanitized input, which is then rendered without escaping in the Order Summary view (view-order-summary.php:32). EPSS data not available; no public exploit identified at time of analysis. Vendor patch status requires verification via changelog.

Technical ContextAI

This vulnerability affects the Gravity Forms WordPress plugin (cpe:2.3:a:gravity_forms:gravity_forms), a form builder commonly used for e-commerce with Product Option fields. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation). The attack exploits a logic flaw in the state validation function: it validates submitted Product Option values by comparing them against legitimate options after applying wp_kses() sanitization (WordPress's HTML/script filtering function), but if the sanitized version matches a valid option, the raw unsanitized payload is stored in the database. When administrators access entry details, the option_label value is output directly in view-order-summary.php line 32 without contextual output escaping, allowing the stored JavaScript to execute in the admin's browser. This represents a sanitization-validation mismatch vulnerability where input validation and output encoding are decoupled.

RemediationAI

Upgrade Gravity Forms to the latest version as specified in the official changelog at https://docs.gravityforms.com/gravityforms-change-log/-released patched version not independently confirmed from provided data; administrators must cross-reference CVE-2026-5109 with changelog entries post-2.10.0. Until patching, implement compensating controls: disable Product Option fields on public-facing forms (eliminates attack vector but breaks e-commerce functionality), restrict form submissions to authenticated users only via Gravity Forms settings (reduces attack surface but impacts public forms), implement Web Application Firewall rules to block HTML/JavaScript in Product Option field submissions (may cause false positives with legitimate special characters), and enable Content Security Policy headers to restrict inline script execution (reduces XSS impact but requires compatibility testing). Review existing form entries for suspicious option_label values containing HTML tags or JavaScript before viewing in admin panel. Note that disabling Product Options fundamentally changes form functionality and is only viable for non-commerce forms.