EUVD-2026-71879
GHSA-34rx-8vxh-qm4m
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Stored XSS requires victim page-load (UI:R); scope changes to victim browser context (S:C); no availability impact on either system.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Post Body Field Value in all versions up to, and including, 2.10.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit survives save-time sanitization because wp_kses_post allows the required HTML tags and attributes, and the client-side tooltip script re-parses the browser-decoded aria-label value as innerHTML while only stripping script elements, leaving onerror and other event-handler attributes fully intact and executable.
AnalysisAI
Stored Cross-Site Scripting in the Gravity Forms WordPress plugin (all versions ≤2.10.5) permits unauthenticated attackers to inject persistent malicious scripts via Post Body Field Values that survive WordPress's standard wp_kses_post sanitization. The bypass exploits a client-side tooltip component that re-parses aria-label attribute content as innerHTML - stripping script tags but leaving event-handler attributes such as onerror intact and executable - meaning any user who subsequently loads an affected page runs the attacker-controlled JavaScript in their browser. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) Gravity Forms plugin installed at version 2.10.5 or earlier on the target WordPress site; (2) a publicly accessible form that includes a Post Body field accepting user-submitted content; (3) the stored form entry must subsequently be rendered in a page viewed by any user, since the XSS payload executes client-side via the tooltip script's innerHTML re-parsing of aria-label values. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-supplied CVSS 3.1 score of 7.2 uses the vector AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update Gravity Forms to the first version released after 2.10.5; the exact patched version must be confirmed via the Gravity Forms changelog at https://docs.gravityforms.com/gravityforms-change-log/ before deployment - the input data identifies 2.10.5 as the last affected version but does not name the fix release explicitly. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Audit all WordPress deployments for Gravity Forms versions ≤2.10.5 and search server logs and database records for XSS payload indicators in form Post Body Fields (script tags, event handlers like onerror/onclick, HTML entities). …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Gravity Forms
View allThe Clockwork SMS clockwork-test-message.php component has XSS via a crafted "to" parameter in a clockwork-test-message
The Gravity Forms WordPress plugin before 2.7.5 does not escape generated URLs before outputting them in attributes, lea
Deserialization of Untrusted Data vulnerability in Rocketgenius Inc. Rated high severity (CVSS 8.3), this vulnerability
Arbitrary file upload in Gravity Forms for WordPress (all versions ≤ 3.0.2) allows unauthenticated attackers to write PH
Arbitrary file disclosure in the Gravity Forms WordPress plugin (all versions through 2.10.4) lets unauthenticated attac
Stored cross-site scripting (XSS) in Gravity Forms WordPress plugin versions ≤2.10.0 allows remote unauthenticated attac
Stored Cross-Site Scripting in Gravity Forms plugin for WordPress through version 2.10.0 allows unauthenticated remote a
Stored XSS in Gravity Forms for WordPress ≤2.10.0 allows unauthenticated remote attackers to inject malicious JavaScript
Stored Cross-Site Scripting in Gravity Forms for WordPress up to 2.10.0 enables unauthenticated attackers to inject mali
Stored Cross-Site Scripting in Gravity Forms plugin for WordPress allows unauthenticated remote attackers to inject mali
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today