CVE-2026-5111: Gravity Forms Plugin Hit by Stored XSS

The Gravity Forms plugin for WordPress, in versions up to and including 2.10.0, is vulnerable to a high-severity Stored Cross-Site Scripting (XSS) flaw, identified as CVE-2026-5111. The National Vulnerability Database reports this vulnerability stems from inadequate input validation and output escaping on “Hidden Product” field values when these are nested within “Repeater” fields. Subfields in repeaters bypass critical state validation checks, and the validate() method for “Hidden Product” only checks the quantity, completely ignoring the product name.

This oversight allows unauthenticated attackers to inject arbitrary web scripts through form submissions. These scripts then execute whenever an administrator views the affected entry details. Given the unauthenticated nature of the attack and its impact on administrators, The National Vulnerability Database assigns this a CVSS score of 7.2 (HIGH), highlighting the significant risk of client-side compromise for WordPress sites using vulnerable Gravity Forms installations.

Attackers can leverage this to steal session cookies, deface pages, or redirect administrators to malicious sites, potentially leading to full site compromise. Defenders need to recognize that XSS, especially stored XSS, is a persistent threat that can turn seemingly innocuous form submissions into vectors for administrative control. The attacker’s calculus here is simple: target a widely used plugin, find a validation bypass, and wait for an admin to trigger the payload.