Gravity Forms <= 2.10.0 — Unauthenticated Stored Cross-Site Scripting via Calculation Product Field in Repeater

Overview

Advisory ID

CVE-2026-5112

Product

Gravity Forms gravityforms

Affected

≤2.10.0

Fixed in

2.10.1

Weakness

CWE-79 Cross-Site Scripting

Required access

No account needed

Published

May 1, 2026 · updated Nov 13, 2026

Credit

Huynh Pham Thanh Luc

Source

Wordfence Intelligence

The Gravity Forms plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting in versions up to and including 2.10.0. This is due to insufficient input validation and output escaping of Calculation Product field product names when rendered inside Repeater fields. The validate() method in the GF_Field_Calculation class only validates the quantity field (.3) and completely ignores the product name field (.1), allowing malicious HTML to pass through validation. When the value is saved, the sanitize_entry_value() method returns the raw value without sanitization for fields where HTML is not expected. Subsequently, when an entry is viewed in wp-admin, the get_value_entry_detail() method concatenates the unescaped product name directly into the output string, which is then rendered by the repeater's get_value_entry_detail() method without further escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts via form submissions that will execute whenever an authenticated administrator with the gravityforms_view_entries capability accesses the entry detail page.

Not sure which version you run? Run a passive check — it reads public files only.

Remediation & mitigations

1. Update to version 2.10.1, or a newer patched version
2. Rotate administrator passwords and application secrets if the site ran a vulnerable version while publicly reachable.