Stored Cross-Site Scripting Vulnerability in Gravity Forms Plugin for WordPress
CVE-2024-13377

7.2HIGH

Key Information:

Vendor

WordPress
Status
Gravity Forms
Vendor
CVE Published:
17 January 2025

What is CVE-2024-13377?

The Gravity Forms plugin for WordPress has a vulnerability that allows unauthenticated attackers to exploit the ā€˜altā€™ parameter. Due to insufficient input sanitization and output escaping in the plugin versions up to 2.9.1.3, attackers can inject malicious scripts. These scripts will execute whenever a user visits the affected page, opening the door for a range of malicious activities, including the hijacking of user sessions or the delivery of malware.

Affected Version(s)

Gravity Forms * <= 2.9.1.3

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://docs.gravityforms.com/gravityforms-change-log/

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Michael Mazzolini
.
The Cyber Security Vulnerability Database.