Gravity Forms
Monthly
Unauthenticated arbitrary file upload in the Gravity Forms WordPress plugin through version 3.1.0.4 can lead to remote code execution on any site whose publicly reachable form contains a File Upload field with its Visibility set to 'Hidden', because hidden upload fields skip the extension-validation step and a rejected file's intact upload state is subsequently persisted by upload_file() without re-validation. Per the assessed vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), no credentials or user interaction are required (PR:N/UI:N) and the attack is fully remote (AV:N), but the non-default hidden File Upload field is a mandatory precondition; a secondary practical limiter is that code execution depends on the server actually executing the uploaded file type in the upload directory. No public exploit code and no CISA KEV entry were identified at time of analysis, yet the combination of unauthenticated access, arbitrary file write and PHP-execution potential makes this a high-priority fix for any installation that meets the precondition.
Stored Cross-Site Scripting in the Gravity Forms WordPress plugin (all versions ≤2.10.5) permits unauthenticated attackers to inject persistent malicious scripts via Post Body Field Values that survive WordPress's standard wp_kses_post sanitization. The bypass exploits a client-side tooltip component that re-parses aria-label attribute content as innerHTML - stripping script tags but leaving event-handler attributes such as onerror intact and executable - meaning any user who subsequently loads an affected page runs the attacker-controlled JavaScript in their browser. No public exploit has been identified at time of analysis, but the zero-privilege injection vector combined with scope-changing browser execution makes this a high-priority patch for any WordPress environment running Gravity Forms.
Arbitrary file upload in Gravity Forms for WordPress (all versions ≤ 3.0.2) allows unauthenticated attackers to write PHP or HTML files with attacker-controlled names to the plugin's temporary upload directory by exploiting chunk-state hash reuse in the `GFAsyncUpload::upload()` function. On NGINX or other non-`.htaccess`-respecting web servers, this leads to remote code execution; on Apache deployments the plugin's bundled `.htaccess` file blocks PHP execution, though attacker-written `.html` files can still produce stored same-origin XSS if a victim visits the generated URL. No public exploit has been identified at time of analysis, and exploitation is meaningfully constrained by two simultaneous prerequisites: a specific form configuration and a non-Apache web server.
Arbitrary file disclosure in the Gravity Forms WordPress plugin (all versions through 2.10.4) lets unauthenticated attackers read sensitive files from the web server by abusing the 'gform_uploaded_files' parameter against the process_send_resume_link endpoint. Reported by Wordfence, the flaw carries CVSS 7.5 and is exfiltrated by directing the traversal-retrieved file to an attacker-controlled email as a form notification attachment. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Stored cross-site scripting (XSS) in Gravity Forms WordPress plugin versions ≤2.10.0 allows remote unauthenticated attackers to inject malicious JavaScript that executes when administrators view form entries. The vulnerability exploits a validation bypass in nested SingleProduct fields within Repeater fields, where product name tampering is not validated. When admins access compromised entries via wp-admin, the unsanitized payload executes in their browser session. CVSS 7.2 (AV:N/AC:L/PR:N/UI:N) indicates network-accessible exploitation without authentication or user interaction during payload delivery, though the attack requires subsequent admin interaction (viewing the entry) for payload execution. No active exploitation confirmed in CISA KEV at time of analysis.
Stored Cross-Site Scripting in Gravity Forms plugin for WordPress through version 2.10.0 allows unauthenticated remote attackers to inject malicious scripts via Hidden Product fields nested in Repeater fields. The vulnerability executes when WordPress administrators view submitted form entries. Attack succeeds because repeater subfields bypass validation, and the Hidden Product field's validate() method checks only quantity while ignoring the product name field, which renders unescaped in entry details. CVSS 7.2 with changed scope indicates potential cross-user impact. EPSS and KEV data not provided; exploitation requires no authentication or user interaction (AV:N/PR:N/UI:N), making this exploitable against any public-facing Gravity Forms installation accepting submissions.
Stored XSS in Gravity Forms for WordPress ≤2.10.0 allows unauthenticated remote attackers to inject malicious JavaScript through Product Option field values that execute when administrators view entry details. The flaw exploits a sanitization bypass: the plugin's state validation accepts values matching wp_kses()-cleaned legitimate options but stores the raw unsanitized input, which is then rendered without escaping in the Order Summary view (view-order-summary.php:32). EPSS data not available; no public exploit identified at time of analysis. Vendor patch status requires verification via changelog.
Stored Cross-Site Scripting in Gravity Forms for WordPress up to 2.10.0 enables unauthenticated attackers to inject malicious scripts through form submissions containing crafted Calculation Product field names within Repeater fields. When administrators view entry details in wp-admin, the unescaped product names execute arbitrary JavaScript in the admin context. CVSS 7.2 (AV:N/AC:L/PR:N/UI:N/S:C) indicates network-accessible exploitation without authentication, though actual impact requires admin interaction. EPSS and KEV data not provided; no public exploit code confirmed at time of analysis. Wordfence reported this vulnerability affecting the Calculation Product field validation and rendering chain.
Stored Cross-Site Scripting in Gravity Forms plugin for WordPress allows unauthenticated remote attackers to inject malicious JavaScript into form entries that executes when administrators view the Entries List page. The vulnerability exploits a flawed dual-hash state validation mechanism that fails to prevent sanitized-then-restored XSS payloads in Consent field hidden inputs. Gravity Forms versions up to 2.10.0 are affected. EPSS data not available; no CISA KEV listing or public POC identified at time of analysis, but Wordfence threat intelligence disclosure indicates vendor awareness and patching activity.
Deserialization of Untrusted Data vulnerability in Rocketgenius Inc. Rated high severity (CVSS 8.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Gravity Forms WordPress plugin before 2.7.5 does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting which could be used against. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Clockwork SMS clockwork-test-message.php component has XSS via a crafted "to" parameter in a clockwork-test-message request to wp-admin/admin.php. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Unauthenticated arbitrary file upload in the Gravity Forms WordPress plugin through version 3.1.0.4 can lead to remote code execution on any site whose publicly reachable form contains a File Upload field with its Visibility set to 'Hidden', because hidden upload fields skip the extension-validation step and a rejected file's intact upload state is subsequently persisted by upload_file() without re-validation. Per the assessed vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), no credentials or user interaction are required (PR:N/UI:N) and the attack is fully remote (AV:N), but the non-default hidden File Upload field is a mandatory precondition; a secondary practical limiter is that code execution depends on the server actually executing the uploaded file type in the upload directory. No public exploit code and no CISA KEV entry were identified at time of analysis, yet the combination of unauthenticated access, arbitrary file write and PHP-execution potential makes this a high-priority fix for any installation that meets the precondition.
Stored Cross-Site Scripting in the Gravity Forms WordPress plugin (all versions ≤2.10.5) permits unauthenticated attackers to inject persistent malicious scripts via Post Body Field Values that survive WordPress's standard wp_kses_post sanitization. The bypass exploits a client-side tooltip component that re-parses aria-label attribute content as innerHTML - stripping script tags but leaving event-handler attributes such as onerror intact and executable - meaning any user who subsequently loads an affected page runs the attacker-controlled JavaScript in their browser. No public exploit has been identified at time of analysis, but the zero-privilege injection vector combined with scope-changing browser execution makes this a high-priority patch for any WordPress environment running Gravity Forms.
Arbitrary file upload in Gravity Forms for WordPress (all versions ≤ 3.0.2) allows unauthenticated attackers to write PHP or HTML files with attacker-controlled names to the plugin's temporary upload directory by exploiting chunk-state hash reuse in the `GFAsyncUpload::upload()` function. On NGINX or other non-`.htaccess`-respecting web servers, this leads to remote code execution; on Apache deployments the plugin's bundled `.htaccess` file blocks PHP execution, though attacker-written `.html` files can still produce stored same-origin XSS if a victim visits the generated URL. No public exploit has been identified at time of analysis, and exploitation is meaningfully constrained by two simultaneous prerequisites: a specific form configuration and a non-Apache web server.
Arbitrary file disclosure in the Gravity Forms WordPress plugin (all versions through 2.10.4) lets unauthenticated attackers read sensitive files from the web server by abusing the 'gform_uploaded_files' parameter against the process_send_resume_link endpoint. Reported by Wordfence, the flaw carries CVSS 7.5 and is exfiltrated by directing the traversal-retrieved file to an attacker-controlled email as a form notification attachment. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Stored cross-site scripting (XSS) in Gravity Forms WordPress plugin versions ≤2.10.0 allows remote unauthenticated attackers to inject malicious JavaScript that executes when administrators view form entries. The vulnerability exploits a validation bypass in nested SingleProduct fields within Repeater fields, where product name tampering is not validated. When admins access compromised entries via wp-admin, the unsanitized payload executes in their browser session. CVSS 7.2 (AV:N/AC:L/PR:N/UI:N) indicates network-accessible exploitation without authentication or user interaction during payload delivery, though the attack requires subsequent admin interaction (viewing the entry) for payload execution. No active exploitation confirmed in CISA KEV at time of analysis.
Stored Cross-Site Scripting in Gravity Forms plugin for WordPress through version 2.10.0 allows unauthenticated remote attackers to inject malicious scripts via Hidden Product fields nested in Repeater fields. The vulnerability executes when WordPress administrators view submitted form entries. Attack succeeds because repeater subfields bypass validation, and the Hidden Product field's validate() method checks only quantity while ignoring the product name field, which renders unescaped in entry details. CVSS 7.2 with changed scope indicates potential cross-user impact. EPSS and KEV data not provided; exploitation requires no authentication or user interaction (AV:N/PR:N/UI:N), making this exploitable against any public-facing Gravity Forms installation accepting submissions.
Stored XSS in Gravity Forms for WordPress ≤2.10.0 allows unauthenticated remote attackers to inject malicious JavaScript through Product Option field values that execute when administrators view entry details. The flaw exploits a sanitization bypass: the plugin's state validation accepts values matching wp_kses()-cleaned legitimate options but stores the raw unsanitized input, which is then rendered without escaping in the Order Summary view (view-order-summary.php:32). EPSS data not available; no public exploit identified at time of analysis. Vendor patch status requires verification via changelog.
Stored Cross-Site Scripting in Gravity Forms for WordPress up to 2.10.0 enables unauthenticated attackers to inject malicious scripts through form submissions containing crafted Calculation Product field names within Repeater fields. When administrators view entry details in wp-admin, the unescaped product names execute arbitrary JavaScript in the admin context. CVSS 7.2 (AV:N/AC:L/PR:N/UI:N/S:C) indicates network-accessible exploitation without authentication, though actual impact requires admin interaction. EPSS and KEV data not provided; no public exploit code confirmed at time of analysis. Wordfence reported this vulnerability affecting the Calculation Product field validation and rendering chain.
Stored Cross-Site Scripting in Gravity Forms plugin for WordPress allows unauthenticated remote attackers to inject malicious JavaScript into form entries that executes when administrators view the Entries List page. The vulnerability exploits a flawed dual-hash state validation mechanism that fails to prevent sanitized-then-restored XSS payloads in Consent field hidden inputs. Gravity Forms versions up to 2.10.0 are affected. EPSS data not available; no CISA KEV listing or public POC identified at time of analysis, but Wordfence threat intelligence disclosure indicates vendor awareness and patching activity.
Deserialization of Untrusted Data vulnerability in Rocketgenius Inc. Rated high severity (CVSS 8.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Gravity Forms WordPress plugin before 2.7.5 does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting which could be used against. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Clockwork SMS clockwork-test-message.php component has XSS via a crafted "to" parameter in a clockwork-test-message request to wp-admin/admin.php. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.