EUVD-2026-26743Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Lifecycle Timeline
4DescriptionCVE.org
The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 2.10.0. This is due to insufficient input validation and output escaping on Hidden Product field values when used inside Repeater fields, where repeater subfields bypass state validation checks and the Hidden Product validate() method only validates the quantity field while ignoring the product name field that is later output without proper escaping in the get_value_entry_detail() method. This makes it possible for unauthenticated attackers to inject arbitrary web scripts through form submissions that will execute whenever an administrator views the entry details.
AnalysisAI
Stored Cross-Site Scripting in Gravity Forms plugin for WordPress through version 2.10.0 allows unauthenticated remote attackers to inject malicious scripts via Hidden Product fields nested in Repeater fields. The vulnerability executes when WordPress administrators view submitted form entries. Attack succeeds because repeater subfields bypass validation, and the Hidden Product field's validate() method checks only quantity while ignoring the product name field, which renders unescaped in entry details. CVSS 7.2 with changed scope indicates potential cross-user impact. EPSS and KEV data not provided; exploitation requires no authentication or user interaction (AV:N/PR:N/UI:N), making this exploitable against any public-facing Gravity Forms installation accepting submissions.
Technical ContextAI
Gravity Forms is a premium WordPress form builder plugin. This vulnerability stems from a validation bypass in the Repeater field component combined with insufficient output escaping (CWE-79). When a Hidden Product field is nested inside a Repeater field, the repeater's architecture bypasses normal state validation checks. The Hidden Product field's validate() method performs incomplete validation, checking only the quantity parameter while ignoring the product name field. Later, the get_value_entry_detail() method outputs this unvalidated product name field directly into the WordPress admin interface without HTML entity encoding or sanitization. This creates a classic stored XSS condition where malicious JavaScript embedded in form submissions persists in the database and executes in the administrative context when entry details are rendered. The affected CPE (cpe:2.3:a:gravity_forms:gravity_forms) indicates the core Gravity Forms plugin, not a specific add-on.
RemediationAI
Immediately upgrade Gravity Forms to version 2.10.1 or later, which should address the validation bypass and output escaping issues per the vendor changelog at https://docs.gravityforms.com/gravityforms-change-log/. If immediate patching is not feasible, implement these compensating controls with noted trade-offs: (1) Disable or remove Repeater fields from public-facing forms containing Hidden Product fields - this breaks legitimate form functionality but eliminates the attack surface; (2) Restrict form submissions to authenticated WordPress users only via Gravity Forms' 'Require user to be logged in' setting - reduces attack surface but blocks anonymous submissions; (3) Implement Web Application Firewall rules to block script tags in POST parameters matching Hidden Product field names - may cause false positives with legitimate form data; (4) Review all existing form entries for suspicious JavaScript patterns in Hidden Product name fields before administrators view them - labor-intensive and doesn't prevent future submissions. The primary fix (upgrading to 2.10.1+) is strongly recommended as workarounds significantly reduce form usability.
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Country State City Dropdown CF7 plugin for WordPress is vulnerable to SQL Injection via the ‘cnt’ and 'sid' paramete
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today