Gravity Forms Plugin Stored XSS: Unauthenticated Attackers Inject Scripts

title: WordPress Gravity Forms Stored XSS - Unauthenticated Script Injection - CVE-2026-5109
id: scw-2026-05-02-ai-1
status: experimental
level: high
description: |
  Detects potential exploitation of CVE-2026-5109, a stored XSS vulnerability in WordPress Gravity Forms. This rule looks for POST requests to 'admin-ajax.php' with the 'gravityforms_get_feeds' action, which is often involved in processing form data. The presence of 'field_id=' in the query string is a strong indicator of an attempt to exploit the product option field vulnerability by injecting script payloads. This allows unauthenticated attackers to inject scripts that execute when an administrator views entry details.
author: SCW Feed Engine (AI-generated)
date: 2026-05-02
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-5109/
tags:
  - attack.initial_access
  - attack.t1190
logsource:
    category: webserver
detection:
  selection:
      cs-uri|contains:
          - '/wp-admin/admin-ajax.php'
      cs-method|exact:
          - 'POST'
      cs-uri-query|contains:
          - 'action=gravityforms_get_feeds'
  selection_payload:
      cs-uri-query|contains:
          - 'field_id=' # This is a placeholder, actual exploit might vary
      condition: selection AND selection_payload
  condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse