PT-2026-36573 · WordPress · Gravity Forms

Tadokun · Published 2026-05-02 · Updated 2026-05-02 · CVE-2026-5109

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Gravity Forms versions prior to 2.10.1

Description The plugin is subject to Stored Cross-Site Scripting due to insufficient validation and output escaping of Product Option field values. The issue occurs because the state validation function accepts submitted values where the wp kses() sanitized version matches a legitimate option value, but the raw unsanitized value is stored in the database. Unauthenticated attackers can inject arbitrary web scripts into entry data. These scripts execute when an administrator views entry details in the Order Summary section, specifically where the option label is output without escaping in the 'view-order-summary.php' file at line 32.

Recommendations Update to a version later than 2.10.0.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-5109

Affected Products

Gravity Forms

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-5109 · Security Note
• https://t.me/cveNotify/161845 · Telegram Post
• https://twitter.com/CVEnew/status/2050488249462997046 · Twitter Post
• https://docs.gravityforms.com/gravityforms-change-log · Note
• https://t.me/CVEtracker/52495 · Telegram Post
• https://twitter.com/KaitanSecurity/status/2050462810316923270 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/651fa700-2462-4c9c-bd13-85f3a53a64df?source=cve · Note
• https://twitter.com/infoflowcloud/status/2050489545666203860 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2050499623492460772 · Twitter Post