What is the CVSS score of CVE-2026-5113?

CVE-2026-5113 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Gravity Forms are affected by CVE-2026-5113?

Gravity Forms plugin versions up to 2.10.0 contain a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious code into form submissions, which executes…

How to fix or mitigate CVE-2026-5113?

Within 24 hours: Inventory all WordPress installations running Gravity Forms and identify current version numbers; disable the Consent field feature if actively used pending patch release. Within 7 days: Monitor Gravity Forms security advisories and Wordfence threat intelligence for patch availability; implement Web Application Firewall rules to block JavaScript payloads in form submissions if available from your WAF vendor. Within 30 days: Apply vendor-released patch immediately upon availability to all affected Gravity Forms instances; conduct log analysis of form submissions from the past 90 days for indicators of exploit attempts.

Gravity Forms CVE-2026-5113

EUVD-2026-26745 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-05-02 Wordfence

WordPress XSS Gravity Forms

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 02, 2026 - 06:31 vuln.today

EUVD ID Assigned

May 02, 2026 - 06:00 euvd

EUVD-2026-26745

Analysis Generated

May 02, 2026 - 06:00 vuln.today

CVE Published

May 02, 2026 - 05:29 nvd

HIGH 7.2

DescriptionCVE.org

The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Consent field hidden inputs in versions up to and including 2.10.0. This is due to a flawed state validation mechanism that fails open when input is sanitized by wp_kses(), combined with insufficient output escaping. The state validation logic creates two hashes (raw input and wp_kses-sanitized input) and only fails validation if BOTH hashes don't match the original state. When an attacker injects XSS payloads using tags stripped by wp_kses() (like <svg>), the sanitized hash matches while the malicious raw value is preserved and saved to the database. When administrators view the Entries List page, the stored malicious consent label is retrieved and output without escaping, causing the XSS payload to execute. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in entries that will execute whenever an authenticated administrator accesses the entries list page.

AnalysisAI

Stored Cross-Site Scripting in Gravity Forms plugin for WordPress allows unauthenticated remote attackers to inject malicious JavaScript into form entries that executes when administrators view the Entries List page. The vulnerability exploits a flawed dual-hash state validation mechanism that fails to prevent sanitized-then-restored XSS payloads in Consent field hidden inputs. Gravity Forms versions up to 2.10.0 are affected. EPSS data not available; no CISA KEV listing or public POC identified at time of analysis, but Wordfence threat intelligence disclosure indicates vendor awareness and patching activity.

Technical ContextAI

Gravity Forms is a premium WordPress form builder plugin (cpe:2.3:a:gravity_forms:gravity_forms). This CWE-79 (Improper Neutralization of Input During Web Page Generation) vulnerability stems from a logic flaw in the plugin's state validation mechanism for Consent field hidden inputs. The validation creates two hashes: one from raw user input and one from wp_kses()-sanitized input. It only fails validation if BOTH hashes mismatch the original state value. When attackers submit payloads using HTML tags that wp_kses() strips (such as <svg>, <script>, or event handlers), the sanitized version passes hash validation while the unsanitized malicious payload is simultaneously stored in the WordPress database. On the backend Entries List page, this stored value is retrieved and rendered without proper output escaping, causing arbitrary JavaScript execution in administrator browsers. This represents a classic stored XSS attack pattern where client-side filtering creates a false sense of security while server-side output encoding is absent.

RemediationAI

Upgrade Gravity Forms plugin to version 2.10.1 or later, which addresses the flawed state validation logic and implements proper output escaping for Consent field labels on the Entries List page. Access the vendor changelog at https://docs.gravityforms.com/gravityforms-change-log/ to confirm the fixed version and review release notes. If immediate patching is not feasible, implement these compensating controls: (1) Disable or remove Consent fields from public-facing forms until upgrade is completed (eliminates the vulnerable code path but breaks forms requiring consent checkboxes); (2) Restrict WordPress admin access to trusted IP addresses via .htaccess, firewall rules, or security plugins like Wordfence (reduces exposure to XSS payload execution but does not prevent payload injection and may disrupt legitimate remote admin access); (3) Implement Content Security Policy headers to restrict inline script execution (mitigates XSS impact but may interfere with legitimate WordPress admin functionality and requires careful tuning). Review existing form entries submitted prior to patching for suspicious content in Consent field labels, as malicious payloads may persist in the database post-upgrade.