Gravity Forms - vulnerabilities (CVEs)
17 CVEs in 2 products, 0 in the last 30 days, newest from 2026-09-19.
Products
- Gravity Forms - 16 CVEs
- Gravity Forms Webhooks - 1 CVEs
Newest CVEs of Gravity Forms
- CVE-2026-84434 - CVSS 9.8 (critical), 2026-09-19: The Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.1.0.4 via the upload_file function. This…
- CVE-2026-16649 - CVSS 7.2 (high), 2026-09-05: The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Post Body Field Value in all versions up to, and including, 2.10.5 due…
- CVE-2026-19513 - CVSS 8.1 (high), 2026-09-01: The Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.0.2. This is due to insufficient…
- CVE-2026-12997 - CVSS 7.5 (high), 2026-07-15: The Gravity Forms plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.10.4 via the 'gform_uploaded_files'…
- CVE-2026-5113 - CVSS 7.2 (high), 2026-05-02: The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Consent field hidden inputs in versions up to and including 2.10.0.…
- CVE-2026-5111 - CVSS 7.2 (high), 2026-05-02: The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 2.10.0. This is due to insufficient input…
- CVE-2026-5110 - CVSS 7.2 (high), 2026-05-02: The Gravity Forms plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting in versions up to and including 2.10.0. This is due to…
- CVE-2026-5109 - CVSS 7.2 (high), 2026-05-02: The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 2.10.0. This is due to insufficient…
- CVE-2026-5112 - CVSS 7.2 (high), 2026-05-02: The Gravity Forms plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting in versions up to and including 2.10.0. This is due to…
- CVE-2026-4406 - CVSS 4.7 (medium), 2026-04-08: The Gravity Forms plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `form_ids` parameter in the `gform_get_config` AJAX action in…
- CVE-2026-4394 - CVSS 6.1 (medium), 2026-04-08: The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Credit Card field's 'Card Type' sub-field (`input_<id>.4`) in all…
- CVE-2026-3492 - CVSS 6.4 (medium), 2026-03-11: The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.9.28.1. This is due to a compound…
- CVE-2025-12974 - CVSS 8.1 (high), 2025-11-18: The Gravity Forms plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the legacy chunked upload mechanism in…
- CVE-2025-12352 - CVSS 9.8 (critical), 2025-11-07: The Gravity Forms plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the copy_post_image() function in all…
- CVE-2024-13845 - CVSS 5.5 (medium), 2025-05-01: The Gravity Forms WebHooks plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.6.0 via the…
- CVE-2024-13377 - CVSS 7.2 (high), 2025-01-17: The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘alt’ parameter in all versions up to, and including, 2.9.1.3 due…
- CVE-2024-13378 - CVSS 5.4 (medium), 2025-01-17: The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘style_settings’ parameter in versions 2.9.0.1 up to, and…
