CVE-2026-5113: Gravity Forms XSS via Flawed Consent Field Validation

The National Vulnerability Database reports CVE-2026-5113, a high-severity (CVSS 7.2) Stored Cross-Site Scripting (XSS) vulnerability in the Gravity Forms plugin for WordPress, affecting versions up to and including 2.10.0. This flaw stems from an inadequate state validation mechanism within the Consent field’s hidden inputs, combined with insufficient output escaping. The core issue lies in how wp_kses() sanitization interacts with the validation logic: an attacker can inject XSS payloads using tags that wp_kses() strips (like <svg>), yet the flawed validation still passes because the sanitized hash matches the expected state, while the malicious raw input is preserved.

This means unauthenticated attackers can inject arbitrary web scripts into form entries. When an authenticated administrator later views the Entries List page, the stored malicious consent label is retrieved and executed without proper escaping. This isn’t just a nuisance; it’s a direct path for attackers to compromise administrator sessions, potentially leading to website defacement, data theft, or further system compromise through privilege escalation.

For defenders, this is a critical reminder that even seemingly robust sanitization functions like wp_kses() can be bypassed if the surrounding validation logic is weak. It highlights the importance of a defense-in-depth approach, where input validation, output encoding, and integrity checks are all rigorously applied and don’t rely on a single point of failure. This specific vulnerability is a prime example of how a ‘fail open’ state in validation can be weaponized.