Stored Cross-Site Scripting Vulnerability in Gravity Forms for WordPress

CVE-2026-5110

What is CVE-2026-5110?

The Gravity Forms plugin for WordPress is susceptible to an unauthenticated stored cross-site scripting vulnerability in versions up to and including 2.10.0. This flaw originates from inadequate input validation and output escaping in the SingleProduct field when utilized within a Repeater field. The validation mechanism, which typically safeguards against unauthorized alterations, can be bypassed, allowing attackers to inject malicious HTML and JavaScript into the product name field. As a consequence, this injected code is saved directly to the database without sanitization. When administrators later access these entries, the injected scripts are executed in their browsers, enabling potential exploitation by unauthenticated attackers.

References