Gravity Forms Plugin: Unauthenticated Stored XSS Puts WordPress Admins at Risk

The Gravity Forms plugin for WordPress, versions up to and including 2.10.0, is vulnerable to unauthenticated stored Cross-Site Scripting (XSS), as detailed by the National Vulnerability Database. This severe flaw (CVE-2026-5112, CVSS: 7.2 HIGH) stems from inadequate input validation and output escaping within the Calculation Product field, specifically when product names are rendered inside Repeater fields. Attackers don’t need authentication to exploit this.

The core issue lies in the GF_Field_Calculation class’s validate() method, which neglects to validate the product name field, allowing malicious HTML to bypass checks. Subsequently, the sanitize_entry_value() method returns this raw, unsanitized value. When an authenticated administrator later views an entry in wp-admin, the get_value_entry_detail() method concatenates the unescaped product name directly into the output. This means an attacker can inject arbitrary web scripts via form submissions.

For defenders, this is a critical vulnerability. Any administrator with gravityforms_view_entries capability who accesses an affected entry detail page will execute the attacker’s script. This allows for session hijacking, malicious redirects, or further client-side attacks, potentially leading to full compromise of the WordPress site. Patching is non-negotiable.