What is the CVSS score of CVE-2026-5110?

CVE-2026-5110 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Gravity Forms are affected by CVE-2026-5110?

Gravity Forms WordPress plugin versions 2.10.0 and earlier contain a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious code into form entries, which…

How to fix or mitigate CVE-2026-5110?

Within 24 hours: Identify all WordPress instances running Gravity Forms plugin and document current installed versions. Within 7 days: Upgrade Gravity Forms to version 2.10.1 or later once released, or implement the compensating control below if upgrade timeline cannot be met. Within 30 days: Conduct security audit of all form entries created during exposure window and review WordPress administrator access logs for unauthorized activity.

Gravity Forms CVE-2026-5110

EUVD-2026-26742 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-05-02 Wordfence

PHP WordPress XSS

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 02, 2026 - 06:32 vuln.today

EUVD ID Assigned

May 02, 2026 - 06:00 euvd

EUVD-2026-26742

Analysis Generated

May 02, 2026 - 06:00 vuln.today

CVE Published

May 02, 2026 - 05:29 nvd

HIGH 7.2

DescriptionCVE.org

The Gravity Forms plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting in versions up to and including 2.10.0. This is due to insufficient input validation and output escaping in the SingleProduct field when used inside a Repeater field. When SingleProduct fields are nested within Repeater fields, the validation flow bypasses the state validation mechanism (failed_state_validation()) that would normally prevent tampering with field values. The validate_subfield() method only calls the field's validate() method, which for SingleProduct fields only validates the quantity field and does not check the product name field for tampering. As a result, an attacker can inject arbitrary HTML and JavaScript into the product name field (input .1). This malicious input is then saved to the database without sanitization because sanitize_entry_value() returns raw values when HTML is not expected for the field type. When an administrator views the entry in wp-admin/admin.php?page=gf_entries, the get_value_entry_detail() method outputs the product name without escaping, causing the stored XSS payload to execute in the administrator's browser. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever an administrator accesses an entry containing the malicious payload.

AnalysisAI

Stored cross-site scripting (XSS) in Gravity Forms WordPress plugin versions ≤2.10.0 allows remote unauthenticated attackers to inject malicious JavaScript that executes when administrators view form entries. The vulnerability exploits a validation bypass in nested SingleProduct fields within Repeater fields, where product name tampering is not validated. When admins access compromised entries via wp-admin, the unsanitized payload executes in their browser session. CVSS 7.2 (AV:N/AC:L/PR:N/UI:N) indicates network-accessible exploitation without authentication or user interaction during payload delivery, though the attack requires subsequent admin interaction (viewing the entry) for payload execution. No active exploitation confirmed in CISA KEV at time of analysis.

Technical ContextAI

Gravity Forms is a premium WordPress form builder plugin (cpe:2.3:a:gravity_forms:gravity_forms). The vulnerability affects the SingleProduct field type when nested inside Repeater fields, a configuration that allows dynamic form sections. WordPress plugins written in PHP commonly use validation pipelines with state checking mechanisms. In this case, the validate_subfield() method only invokes the field's validate() method, which for SingleProduct fields validates quantity but not product names. The failed_state_validation() mechanism that normally prevents field value tampering is bypassed for nested contexts. After bypassing validation, the sanitize_entry_value() method returns raw unsanitized data because it does not expect HTML content in product name fields. The get_value_entry_detail() method then outputs this data without escaping when rendering entry details in the WordPress admin panel (wp-admin/admin.php?page=gf_entries). This chain of missing input validation (CWE-79: Improper Neutralization of Input During Web Page Generation) creates a stored XSS condition where malicious scripts persist in the database and execute in privileged admin contexts.

RemediationAI

Update Gravity Forms to version 2.10.1 or later if available per the vendor changelog at https://docs.gravityforms.com/gravityforms-change-log/. The CVE references the changelog but does not cite a specific patched version - administrators should verify the latest release addresses CVE-2026-5110. As an immediate compensating control if patching is delayed, review all Gravity Forms configurations and temporarily disable or remove SingleProduct fields nested inside Repeater fields until upgrade completion. This mitigation eliminates the vulnerable code path but breaks functionality for forms using this feature combination. Alternatively, implement strict Content Security Policy (CSP) headers to prevent inline JavaScript execution in wp-admin (add 'script-src self' directive), though this may interfere with legitimate WordPress admin JavaScript and requires testing. Review all existing form entries for suspicious HTML content in product name fields via database query (wp_gf_entry_meta table) and sanitize any detected payloads. These workarounds provide defense-in-depth but do not fix the root cause - upgrading remains the primary remediation path per Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/f9135799-00db-447d-b795-faafeafbce67?source=cve.