What is the CVSS score of CVE-2026-5111?

CVE-2026-5111 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Gravity Forms are affected by CVE-2026-5111?

Gravity Forms plugin for WordPress through version 2.10.0 contains a stored cross-site scripting vulnerability allowing unauthenticated attackers to inject malicious scripts through form submissions,…

How to fix or mitigate CVE-2026-5111?

Within 24 hours: Identify all WordPress installations running Gravity Forms; disable or restrict public form submissions on affected versions until patched. Within 7 days: Contact Gravity Forms support to confirm patch timeline and interim recommendations; implement Web Application Firewall (WAF) rules to block script injection patterns in form field submissions. Within 30 days: Apply vendor-released patch immediately upon availability; conduct security audit of existing form submissions for injected payloads; review administrator access logs for unauthorized activity.

Gravity Forms CVE-2026-5111

EUVD-2026-26743 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-05-02 Wordfence

WordPress XSS Gravity Forms

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 02, 2026 - 06:31 vuln.today

EUVD ID Assigned

May 02, 2026 - 06:00 euvd

EUVD-2026-26743

Analysis Generated

May 02, 2026 - 06:00 vuln.today

CVE Published

May 02, 2026 - 05:29 nvd

HIGH 7.2

DescriptionCVE.org

The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 2.10.0. This is due to insufficient input validation and output escaping on Hidden Product field values when used inside Repeater fields, where repeater subfields bypass state validation checks and the Hidden Product validate() method only validates the quantity field while ignoring the product name field that is later output without proper escaping in the get_value_entry_detail() method. This makes it possible for unauthenticated attackers to inject arbitrary web scripts through form submissions that will execute whenever an administrator views the entry details.

AnalysisAI

Stored Cross-Site Scripting in Gravity Forms plugin for WordPress through version 2.10.0 allows unauthenticated remote attackers to inject malicious scripts via Hidden Product fields nested in Repeater fields. The vulnerability executes when WordPress administrators view submitted form entries. Attack succeeds because repeater subfields bypass validation, and the Hidden Product field's validate() method checks only quantity while ignoring the product name field, which renders unescaped in entry details. CVSS 7.2 with changed scope indicates potential cross-user impact. EPSS and KEV data not provided; exploitation requires no authentication or user interaction (AV:N/PR:N/UI:N), making this exploitable against any public-facing Gravity Forms installation accepting submissions.

Technical ContextAI

Gravity Forms is a premium WordPress form builder plugin. This vulnerability stems from a validation bypass in the Repeater field component combined with insufficient output escaping (CWE-79). When a Hidden Product field is nested inside a Repeater field, the repeater's architecture bypasses normal state validation checks. The Hidden Product field's validate() method performs incomplete validation, checking only the quantity parameter while ignoring the product name field. Later, the get_value_entry_detail() method outputs this unvalidated product name field directly into the WordPress admin interface without HTML entity encoding or sanitization. This creates a classic stored XSS condition where malicious JavaScript embedded in form submissions persists in the database and executes in the administrative context when entry details are rendered. The affected CPE (cpe:2.3:a:gravity_forms:gravity_forms) indicates the core Gravity Forms plugin, not a specific add-on.

RemediationAI

Immediately upgrade Gravity Forms to version 2.10.1 or later, which should address the validation bypass and output escaping issues per the vendor changelog at https://docs.gravityforms.com/gravityforms-change-log/. If immediate patching is not feasible, implement these compensating controls with noted trade-offs: (1) Disable or remove Repeater fields from public-facing forms containing Hidden Product fields - this breaks legitimate form functionality but eliminates the attack surface; (2) Restrict form submissions to authenticated WordPress users only via Gravity Forms' 'Require user to be logged in' setting - reduces attack surface but blocks anonymous submissions; (3) Implement Web Application Firewall rules to block script tags in POST parameters matching Hidden Product field names - may cause false positives with legitimate form data; (4) Review all existing form entries for suspicious JavaScript patterns in Hidden Product name fields before administrators view them - labor-intensive and doesn't prevent future submissions. The primary fix (upgrading to 2.10.1+) is strongly recommended as workarounds significantly reduce form usability.