Reflected Cross-Site Scripting Vulnerability in Gravity Forms Plugin for WordPress
CVE-2026-4406
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 7 April 2026
Badges
What is CVE-2026-4406?
The Gravity Forms plugin for WordPress has a vulnerability that allows reflected cross-site scripting through the form_ids parameter in the gform_get_config AJAX action. This issue affects all versions up to and including 2.9.30. It stems from the GFCommon::send_json() method outputting JSON data wrapped in HTML comment delimiters, using echo and wp_die(). Consequently, it serves responses with a Content-Type: text/html header instead of application/json. The output of the wp_json_encode() function fails to HTML-encode angle brackets within JSON string values, permitting the injection of HTML or script tags in the form_ids parameter. This flaw poses risks particularly when unauthenticated attackers trick users into interacting with malicious links, making it possible to execute scripts on affected pages.
Affected Version(s)
Gravity Forms 0 <= 2.9.30
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.
References
CVSS V3.1
Timeline
- 🟡
Public PoC available
- 👾
Exploit known to exist
Vulnerability published
Vulnerability Reserved