Gravity Forms <= 2.10.0 — Unauthenticated Stored Cross-Site Scripting via Hidden Product Field in Repeater
CVE-2026-5111Published · Updated Action summary
Affected: ≤2.10.0Update to 2.10.1 or newer
All remediation stepsOn this page3
Overview
- Advisory ID
- CVE-2026-5111
- Product
- Gravity Forms gravityforms
- Affected
- ≤2.10.0
- Fixed in
- 2.10.1
- Weakness
- CWE-79 Cross-Site Scripting
- Required access
- No account needed
- Published
- · updated
- Credit
- Huynh Pham Thanh Luc
- Source
- Wordfence Intelligence
- Affected≤ 2.10.0
- Patched in2.10.1
Update to 2.10.1 or newer.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:NWhat does this vector mean?
AV:NAttack vector- Network
AC:LAttack complexity- Low
PR:NPrivileges required- None
UI:NUser interaction- None
S:CScope- Changed
C:LConfidentiality- Low
I:LIntegrity- Low
A:NAvailability- None
The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 2.10.0. This is due to insufficient input validation and output escaping on Hidden Product field values when used inside Repeater fields, where repeater subfields bypass state validation checks and the Hidden Product validate() method only validates the quantity field while ignoring the product name field that is later output without proper escaping in the get_value_entry_detail() method. This makes it possible for unauthenticated attackers to inject arbitrary web scripts through form submissions that will execute whenever an administrator views the entry details.
Not sure which version you run? Run a passive check — it reads public files only.
Remediation & mitigations
- Update to version 2.10.1, or a newer patched version
- Rotate administrator passwords and application secrets if the site ran a vulnerable version while publicly reachable.
References & provenance
Proof-of-concept & detection
No public proof-of-concept or detection template is known for this vulnerability.
Advisories & patches
- Advisorywordfence.com
Related CVEs
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| High7.2 | Unauthenticated Stored Cross-Site Scripting via Post Excerpt / Post Custom Field / Rich-Text Paragraph Field Values ≤3.1.1Update to 3.1.2 | CVE-2026-90437 | |
| Critical9.8 | Unauthenticated PHP Object Injection via Post Custom Field ≤3.1.2Update to 3.1.3 | CVE-2026-103039 | |
| High7.2 | Unauthenticated Stored Cross-Site Scripting via List Field ≤3.1.2Update to 3.1.3 | CVE-2026-97645 | |
| High8.1 | Unauthenticated PHP Object Injection <3.1.1Update to 3.1.1 | CVE-2026-97296 | |
| Critical9.8 | Unauthenticated Arbitrary File Upload via Hidden File Upload Field ≤3.1.0.4Update to 3.1.1 | CVE-2026-84434 |
- High7.2Unauthenticated Stored Cross-Site Scripting via Post Excerpt / Post Custom Field / Rich-Text Paragraph Field Values
≤3.1.1Update to 3.1.2
- Critical9.8Unauthenticated PHP Object Injection via Post Custom Field
≤3.1.2Update to 3.1.3
- High7.2Unauthenticated Stored Cross-Site Scripting via List Field
≤3.1.2Update to 3.1.3
- High8.1Unauthenticated PHP Object Injection
<3.1.1Update to 3.1.1
- Critical9.8Unauthenticated Arbitrary File Upload via Hidden File Upload Field
≤3.1.0.4Update to 3.1.1
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| High7.2 | Unauthenticated Stored DOM-Based Cross-Site Scripting via Image Alt Attribute in .wp-caption Containers | CVE-2026-120687 | |
| Medium6.4 | Authenticated (Subscriber+) Stored Cross-Site Scripting via 'Popup' Shortcode Attribute via Profile Video | CVE-2026-110531 | |
| Medium5.4 | Unauthenticated Stored Cross-Site Scripting via 'title' Attribute of [bf_login_form] Shortcode | CVE-2026-127115 | |
| High7.2 | Unauthenticated Stored Cross-Site Scripting via Multipart Field Name | CVE-2026-116753 |
- High7.2Unauthenticated Stored DOM-Based Cross-Site Scripting via Image Alt Attribute in .wp-caption Containers
Lightbox & Modal Popup WordPress Plugin – FooBox
≤2.8.7Update to 2.8.8
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'Popup' Shortcode Attribute via Profile Video
FV Player 8
≤8.1.9Update to 8.2.0
- Medium5.4Unauthenticated Stored Cross-Site Scripting via 'title' Attribute of [bf_login_form] Shortcode
BuddyForms
≤2.10.6Update to 2.10.7
- High7.2Unauthenticated Stored Cross-Site Scripting via Multipart Field Name
Multi Step for Contact Form 7
≤2.9.1Update to 2.9.2
Timeline
CVE published
Severity high, CVSS 7.2
Record last updated
Sources & licenses
Wordfence record- Vulnerability data
- Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Licensed under the CC BY-SA 4.0.
- CVE® identifiers
- Copyright 1999-2026 The MITRE Corporation. Used under the CVE Program. CVE® is a registered trademark of The MITRE Corporation.
- CVSS / CWE
- National Vulnerability Database (NVD), shown unmodified. This product uses the NVD API but is not endorsed or certified by the NVD.
- VulnCrest content
- Summary, remediation guidance and page layout © VulnCrest. Not sourced from NVD.