PT-2026-36575 · WordPress · Gravity Forms

Tadokun · Published 2026-05-02 · Updated 2026-05-02 · CVE-2026-5111

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Gravity Forms versions prior to 2.10.1

Description Stored Cross-Site Scripting occurs due to insufficient input validation and output escaping on Hidden Product field values when used inside Repeater fields. Specifically, repeater subfields bypass state validation checks, and the validate() method for Hidden Product only validates the quantity field, ignoring the product name field. This product name is subsequently output without proper escaping in the get value entry detail() method, allowing unauthenticated attackers to inject arbitrary web scripts through form submissions that execute when an administrator views the entry details.

Recommendations Update to a version later than 2.10.0.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-5111

Affected Products

Gravity Forms

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-5111 · Security Note
• https://twitter.com/CVEnew/status/2050488247730802825 · Twitter Post
• https://twitter.com/KaitanSecurity/status/2050462829421977888 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2050494503832764466 · Twitter Post
• https://twitter.com/infoflowcloud/status/2050489529627214092 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/a50e7042-bf7b-49d8-8e62-d01ecdd769fd?source=cve · Note
• https://t.me/cveNotify/161847 · Telegram Post
• https://t.me/CVEtracker/52497 · Telegram Post
• https://docs.gravityforms.com/gravityforms-change-log · Note