Stored Cross-Site Scripting Vulnerability in Gravity Forms Plugin for WordPress

CVE-2026-5113

What is CVE-2026-5113?

The Gravity Forms plugin for WordPress is susceptible to Stored Cross-Site Scripting (XSS) due to improper state validation in its consent field hidden inputs. In versions up to and including 2.10.0, the flawed mechanism fails to adequately verify input, allowing attackers to inject XSS payloads that remain undetected during sanitization. This occurs because the validation logic only checks if both raw and sanitized hashes match the original state. Consequently, an attacker can embed harmful scripts using tags removed by the wp_kses() function. As a result, when administrators access the Entries List page, these malicious scripts can be executed, leading to serious security implications for the site.

References