EUVD-2026-26744Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Lifecycle Timeline
4DescriptionCVE.org
The Gravity Forms plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting in versions up to and including 2.10.0. This is due to insufficient input validation and output escaping of Calculation Product field product names when rendered inside Repeater fields. The validate() method in the GF_Field_Calculation class only validates the quantity field (.3) and completely ignores the product name field (.1), allowing malicious HTML to pass through validation. When the value is saved, the sanitize_entry_value() method returns the raw value without sanitization for fields where HTML is not expected. Subsequently, when an entry is viewed in wp-admin, the get_value_entry_detail() method concatenates the unescaped product name directly into the output string, which is then rendered by the repeater's get_value_entry_detail() method without further escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts via form submissions that will execute whenever an authenticated administrator with the gravityforms_view_entries capability accesses the entry detail page.
AnalysisAI
Stored Cross-Site Scripting in Gravity Forms for WordPress up to 2.10.0 enables unauthenticated attackers to inject malicious scripts through form submissions containing crafted Calculation Product field names within Repeater fields. When administrators view entry details in wp-admin, the unescaped product names execute arbitrary JavaScript in the admin context. CVSS 7.2 (AV:N/AC:L/PR:N/UI:N/S:C) indicates network-accessible exploitation without authentication, though actual impact requires admin interaction. EPSS and KEV data not provided; no public exploit code confirmed at time of analysis. Wordfence reported this vulnerability affecting the Calculation Product field validation and rendering chain.
Technical ContextAI
Gravity Forms is a premium WordPress form builder plugin. This vulnerability exploits a validation and output encoding gap in the interaction between Calculation Product fields and Repeater fields. The GF_Field_Calculation class's validate() method only checks the quantity field (.3) while completely bypassing the product name field (.1). The sanitize_entry_value() method returns raw unsanitized values for field types where HTML is not expected, and the get_value_entry_detail() method directly concatenates these unescaped product names into the output string. The Repeater field's rendering method inherits this unescaped content, creating a classic stored XSS condition. CWE-79 (Improper Neutralization of Input During Web Page Generation) applies specifically to the lack of output encoding at the display layer. The attack surface exists at the public form submission endpoint but the payload executes only when an admin views the entry, making this a privilege escalation vector from unauthenticated user to administrator context.
RemediationAI
Upgrade Gravity Forms plugin to version 2.10.1 or later, which should address the input validation and output escaping gaps in the Calculation Product field rendering chain (consult https://docs.gravityforms.com/gravityforms-change-log/ for confirmed fix version). If immediate patching is not feasible, implement these compensating controls: disable public access to forms containing Calculation Product fields within Repeater fields and require authentication for form submissions (reduces attack surface to authenticated users only, accepting the trade-off of limiting form functionality); implement Web Application Firewall rules to detect and block suspicious HTML/JavaScript patterns in form POST data targeting Gravity Forms endpoints (may generate false positives on legitimate HTML entity usage); configure Content Security Policy headers to restrict inline script execution in wp-admin, though this may interfere with legitimate WordPress admin functionality and requires extensive testing. Administrative controls: restrict gravityforms_view_entries capability to minimum necessary personnel, reducing the pool of potential victims; educate administrators not to view form entries from untrusted sources without previewing in isolated environments. Note that WAF and CSP controls add defense-in-depth but do not eliminate the vulnerability and may impact usability.
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Country State City Dropdown CF7 plugin for WordPress is vulnerable to SQL Injection via the ‘cnt’ and 'sid' paramete
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today