PT-2026-31049 · Gravity Forms · Gravity Forms

Tadokun · Published 2026-04-07 · Updated 2026-04-08 · CVE-2026-4394

NVD

CVSS v3.1

6.1

Medium

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Credit Card field's 'Card Type' sub-field (input <id>.4) in all versions up to, and including, 2.9.30. This is due to the get value entry detail() method in the GF Field CreditCard class outputting the card type value without escaping, combined with get value save entry() accepting and storing unsanitized user input for the input <id>.4 parameter. The Card Type field is not rendered on the frontend form (it is normally derived from the card number), but the backend submission parser blindly accepts it if included in the POST request. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute when an administrator views the form entry in the WordPress dashboard.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-4394

Affected Products

Gravity Forms

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-4394 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/6f38d7b7-6df6-47a2-a9ba-87ef1f039e44?source=cve · Note
• https://docs.gravityforms.com/gravityforms-change-log · Note
• https://plugins.trac.wordpress.org/browser/gravityforms/tags/2.9.25/includes/fields/class-gf-field-creditcard.php#L516 · Note
• https://plugins.trac.wordpress.org/browser/gravityforms/trunk/includes/fields/class-gf-field-creditcard.php#L577 · Note
• https://plugins.trac.wordpress.org/browser/gravityforms/trunk/includes/fields/class-gf-field-creditcard.php#L516 · Note
• https://plugins.trac.wordpress.org/browser/gravityforms/tags/2.9.25/includes/fields/class-gf-field-creditcard.php#L577 · Note