PT-2026-36577 · WordPress · Gravity Forms

Tadokun · Published 2026-05-02 · Updated 2026-05-02 · CVE-2026-5113

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Gravity Forms versions prior to 2.10.1

Description The plugin is subject to Stored Cross-Site Scripting (XSS) via hidden inputs in the Consent field. This occurs because of a flawed state validation mechanism that fails open when input is sanitized by wp kses(), combined with insufficient output escaping. The validation logic generates two hashes (one for raw input and one for wp kses() sanitized input) and only fails if both hashes differ from the original state. An unauthenticated attacker can inject XSS payloads using tags stripped by wp kses(), such as <svg>, allowing the malicious raw value to be saved to the database. The payload executes when an authenticated administrator views the Entries List page, as the stored consent label is output without proper escaping.

Recommendations Update to a version later than 2.10.0.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-5113

Affected Products

Gravity Forms

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-5113 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/5890c0f1-f549-4076-9d57-74f5eaffdcb3?source=cve · Note
• https://twitter.com/infoflowcloud/status/2050489591069581397 · Twitter Post
• https://twitter.com/CVEnew/status/2050488251157520504 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2050489384344953094 · Twitter Post
• https://t.me/CVEtracker/52493 · Telegram Post
• https://docs.gravityforms.com/gravityforms-change-log · Note