WordPress plugin
Gravity Forms security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 30 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical8
- High14
- Medium8
- Low0
All Gravity Forms vulnerabilities
- High7.2Unauthenticated Stored Cross-Site Scripting via Post Excerpt / Post Custom Field / Rich-Text Paragraph Field Values
≤3.1.1Update to 3.1.2
- Critical9.8Unauthenticated PHP Object Injection via Post Custom Field
≤3.1.2Update to 3.1.3
- High7.2Unauthenticated Stored Cross-Site Scripting via List Field
≤3.1.2Update to 3.1.3
- High8.1Unauthenticated PHP Object Injection
<3.1.1Update to 3.1.1
- Critical9.8Unauthenticated Arbitrary File Upload via Hidden File Upload Field
≤3.1.0.4Update to 3.1.1
- High7.2Unauthenticated Stored Cross-Site Scripting via Post Body Field Value
≤2.10.5Update to 3.0.0
- High8.1Unauthenticated Arbitrary File Upload via State/Chunk Hash Confusion
≤3.0.2Update to 3.0.3
- High7.5Unauthenticated Arbitrary File Read via 'gform_uploaded_files' Parameter
≤2.10.4Update to 2.10.5
- Critical9.1Unauthenticated Arbitrary File Deletion
≤2.10.0.1Update to 2.10.1
- High7.2Unauthenticated Stored Cross-Site Scripting via Single Product Field Inside Repeater
≤2.10.0Update to 2.10.1
- High7.2Unauthenticated Stored Cross-Site Scripting via Consent Field Hidden Input
≤2.9.30Update to 2.9.31
- High7.2Unauthenticated Stored Cross-Site Scripting via Calculation Product Field in Repeater
≤2.10.0Update to 2.10.1
- High7.2Unauthenticated Stored Cross-Site Scripting via Product Option
≤2.10.0Update to 2.10.1
- High7.2Unauthenticated Stored Cross-Site Scripting via Hidden Product Field in Repeater
≤2.10.0Update to 2.10.1
- Medium6.1Unauthenticated Stored Cross-Site Scripting via Credit Card 'Card Type' Sub-Field
≤2.9.30Update to 2.9.31
- Medium4.7Reflected Cross-Site Scripting via 'form_ids' Parameter
≤2.9.30Update to 2.9.31
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Form Title
≤2.9.28Update to 2.9.29
- Critical9.8Unauthenticated Arbitrary File Upload
≤2.9.23.0Update to 2.9.23.1
- High8.1Unauthenticated Arbitrary File Upload via Legacy Chunked Upload
≤2.9.21.1Update to 2.9.22
- Critical9.8Unauthenticated Arbitrary File Upload via 'copy_post_image'
≤2.9.20Update to 2.9.21
- High7.2Unauthenticated Stored Cross-Site Scripting via 'alt' parameter
≤2.9.1.3Update to 2.9.2
- Medium5.42.9.1.3 - Unauthenticated Stored Cross-Site Scripting via 'style_settings' parameter
2.9.0.1 – 2.9.1.3Update to 2.9.2
- Medium6.1Reflected Cross-Site Scripting
≤2.7.4Update to 2.7.5
- Critical9.8Unauthenticated PHP Object Injection
≤2.7.3Update to 2.7.4
- High7.5Information Exposure
≤2.4.8Update to 2.4.9
- Medium5.4Cross-Site Scripting
≤2.0.6.5Update to 2.0.7
- Medium4.7Cross-Site Scripting
≤1.9.15.11Update to 1.9.16
- Medium5.4Cross-Site Scripting
≤1.9.6Update to 1.9.7
- Critical9.1SQL Injection
≤1.9.3.5Update to 1.9.3.6
- Critical9.8Arbitrary File Upload
<1.8.20Update to 1.8.20
Gravity Forms: common questions
Does Gravity Forms have known vulnerabilities?
Yes. VulnCrest Radar lists 30 known vulnerabilities in Gravity Forms: 8 critical, 14 high, 8 medium. None are known to affect version null.
How do I check which version of Gravity Forms I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Gravity Forms vulnerability?
CVE-2026-90437, published Oct 29, 2026: Gravity Forms <= 3.1.1 - Unauthenticated Stored Cross-Site Scripting via Post Excerpt / Post Custom Field / Rich-Text Paragraph Field Values. Severity: High (CVSS 7.2).
Is any Gravity Forms vulnerability listed in CISA KEV?
No. None of the known Gravity Forms vulnerabilities is currently listed in the CISA KEV catalog.