CVE-2026-4406: Gravity Forms <= 2.9.30 - Reflected Cross-Site Scripting via 'form_ids' Paramete

In plain English

A medium-severity cross-site scripting in Gravity Forms from Gravity Forms. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Official description

The Gravity Forms plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `form_ids` parameter in the `gform_get_config` AJAX action in all versions up to, and including, 2.9.30. This is due to the `GFCommon::send_json()` method outputting JSON-encoded data wrapped in HTML comment delimiters using `echo` and `wp_die()`, which serves the response with a `Content-Type: text/html` header instead of `application/json`. The `wp_json_encode()` function does not HTML-encode angle brackets within JSON string values, allowing injected HTML/script tags in `form_ids` array values to be parsed and executed by the browser. The required `config_nonce` is generated with `wp_create_nonce('gform_config_ajax')` and is publicly embedded on every page that renders a Gravity Forms form, making it identical for all unauthenticated visitors within the same 12-hour nonce tick. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This vulnerability cannot be exploited against users who are authenticated on the target system, but could be used to alter the target page.

Vendor	Product	Versions
Gravity Forms	Gravity Forms	0 – through 2.9.30

Vendor

Product

Versions

Gravity Forms

0 – through 2.9.30

CVE-2026-4406Gravity Forms <= 2.9.30 - Reflected Cross-Site Scripting via 'form_ids' Parameter

In plain English

Official description

Affected products (as reported)

References