PT-2026-36576 · WordPress · Gravity Forms

Tadokun · Published 2026-05-02 · Updated 2026-05-02 · CVE-2026-5112

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Gravity Forms versions prior to 2.10.1

Description The plugin is subject to unauthenticated stored Cross-Site Scripting (XSS), a flaw where malicious scripts are permanently stored on the target server and executed in the browser of a user. This occurs because of insufficient input validation and output escaping of Calculation Product field product names within Repeater fields. Specifically, the validate() method in the GF Field Calculation class fails to validate the product name field, and the sanitize entry value() method saves the raw value without sanitization. When an administrator with the gravityforms view entries capability views the entry detail page, the get value entry detail() method concatenates the unescaped product name into the output string, allowing arbitrary web scripts to execute.

Recommendations Update to a version later than 2.10.0.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-5112

Affected Products

Gravity Forms

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-5112 · Security Note
• https://twitter.com/CVEnew/status/2050488250352185831 · Twitter Post
• https://t.me/CVEtracker/52494 · Telegram Post
• https://docs.gravityforms.com/gravityforms-change-log · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/63973f61-81f0-4fc8-810c-a15734ff824e?source=cve · Note
• https://twitter.com/VulmonFeeds/status/2050491944120311990 · Twitter Post
• https://twitter.com/infoflowcloud/status/2050489563626209722 · Twitter Post
• https://t.me/cveNotify/161848 · Telegram Post