What is the CVSS score of CVE-2026-5112?

CVE-2026-5112 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Gravity Forms are affected by CVE-2026-5112?

Gravity Forms for WordPress versions up to 2.10.0 contain a stored cross-site scripting vulnerability allowing unauthenticated attackers to inject malicious scripts through form submissions, which…

How to fix or mitigate CVE-2026-5112?

Within 24 hours: Identify all WordPress instances running Gravity Forms versions 2.10.0 and earlier; document current version in use. Within 7 days: Disable or restrict access to Gravity Forms containing Calculation Product fields in Repeater field configurations; limit WordPress dashboard entry access to essential administrators only. Within 30 days: Monitor vendor advisory channels for patch release; evaluate upgrading beyond version 2.10.0 once patched version is released and tested in staging environment.

Gravity Forms CVE-2026-5112

EUVD-2026-26744 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-05-02 Wordfence

WordPress XSS Gravity Forms

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 02, 2026 - 06:31 vuln.today

EUVD ID Assigned

May 02, 2026 - 06:00 euvd

EUVD-2026-26744

Analysis Generated

May 02, 2026 - 06:00 vuln.today

CVE Published

May 02, 2026 - 05:29 nvd

HIGH 7.2

DescriptionCVE.org

The Gravity Forms plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting in versions up to and including 2.10.0. This is due to insufficient input validation and output escaping of Calculation Product field product names when rendered inside Repeater fields. The validate() method in the GF_Field_Calculation class only validates the quantity field (.3) and completely ignores the product name field (.1), allowing malicious HTML to pass through validation. When the value is saved, the sanitize_entry_value() method returns the raw value without sanitization for fields where HTML is not expected. Subsequently, when an entry is viewed in wp-admin, the get_value_entry_detail() method concatenates the unescaped product name directly into the output string, which is then rendered by the repeater's get_value_entry_detail() method without further escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts via form submissions that will execute whenever an authenticated administrator with the gravityforms_view_entries capability accesses the entry detail page.

AnalysisAI

Stored Cross-Site Scripting in Gravity Forms for WordPress up to 2.10.0 enables unauthenticated attackers to inject malicious scripts through form submissions containing crafted Calculation Product field names within Repeater fields. When administrators view entry details in wp-admin, the unescaped product names execute arbitrary JavaScript in the admin context. CVSS 7.2 (AV:N/AC:L/PR:N/UI:N/S:C) indicates network-accessible exploitation without authentication, though actual impact requires admin interaction. EPSS and KEV data not provided; no public exploit code confirmed at time of analysis. Wordfence reported this vulnerability affecting the Calculation Product field validation and rendering chain.

Technical ContextAI

Gravity Forms is a premium WordPress form builder plugin. This vulnerability exploits a validation and output encoding gap in the interaction between Calculation Product fields and Repeater fields. The GF_Field_Calculation class's validate() method only checks the quantity field (.3) while completely bypassing the product name field (.1). The sanitize_entry_value() method returns raw unsanitized values for field types where HTML is not expected, and the get_value_entry_detail() method directly concatenates these unescaped product names into the output string. The Repeater field's rendering method inherits this unescaped content, creating a classic stored XSS condition. CWE-79 (Improper Neutralization of Input During Web Page Generation) applies specifically to the lack of output encoding at the display layer. The attack surface exists at the public form submission endpoint but the payload executes only when an admin views the entry, making this a privilege escalation vector from unauthenticated user to administrator context.

RemediationAI

Upgrade Gravity Forms plugin to version 2.10.1 or later, which should address the input validation and output escaping gaps in the Calculation Product field rendering chain (consult https://docs.gravityforms.com/gravityforms-change-log/ for confirmed fix version). If immediate patching is not feasible, implement these compensating controls: disable public access to forms containing Calculation Product fields within Repeater fields and require authentication for form submissions (reduces attack surface to authenticated users only, accepting the trade-off of limiting form functionality); implement Web Application Firewall rules to detect and block suspicious HTML/JavaScript patterns in form POST data targeting Gravity Forms endpoints (may generate false positives on legitimate HTML entity usage); configure Content Security Policy headers to restrict inline script execution in wp-admin, though this may interfere with legitimate WordPress admin functionality and requires extensive testing. Administrative controls: restrict gravityforms_view_entries capability to minimum necessary personnel, reducing the pool of potential victims; educate administrators not to view form entries from untrusted sources without previewing in isolated environments. Note that WAF and CSP controls add defense-in-depth but do not eliminate the vulnerability and may impact usability.