GGravity Forms

Products

Exploited and recent CVEs

• CVE-2026-103039 Critical 9.8 Gravity Forms <= 3.1.2 - Unauthenticated PHP Object Injection via Post Custom Field 0.5%
• CVE-2026-97645 High 7.2 Gravity Forms <= 3.1.2 - Unauthenticated Stored Cross-Site Scripting via List Field 0.2%
• CVE-2026-90437 High 7.2 Gravity Forms <= 3.1.1 - Unauthenticated Stored Cross-Site Scripting via Post Excerpt / Post Custom Field / Rich-Text Paragraph Field Values 0.2%
• CVE-2026-84434 Critical 9.8 Gravity Forms <= 3.1.0.4 - Unauthenticated Arbitrary File Upload via Hidden File Upload Field 3.9%
• CVE-2026-16649 High 7.2 Gravity Forms <= 2.10.5 - Unauthenticated Stored Cross-Site Scripting via Post Body Field Value 0.3%
• CVE-2026-19513 High 8.1 Gravity Forms <= 3.0.2 - Unauthenticated Arbitrary File Upload via State/Chunk Hash Confusion 0.7%
• CVE-2026-12997 High 7.5 Gravity Forms <= 2.10.4 - Unauthenticated Arbitrary File Read via 'gform_uploaded_files' Parameter 0.9%
• CVE-2026-5110 High 7.2 Gravity Forms <= 2.10.0 - Unauthenticated Stored Cross-Site Scripting via Single Product Field Inside Repeater 0.2%
• CVE-2026-5111 High 7.2 Gravity Forms <= 2.10.0 - Unauthenticated Stored Cross-Site Scripting via Hidden Product Field in Repeater 0.3%
• CVE-2026-5109 High 7.2 Gravity Forms <= 2.10.0 - Unauthenticated Stored Cross-Site Scripting via Product Option 0.2%
• CVE-2026-5112 High 7.2 Gravity Forms <= 2.10.0 - Unauthenticated Stored Cross-Site Scripting via Calculation Product Field in Repeater 0.2%
• CVE-2026-5113 High 7.2 Gravity Forms <= 2.10.0 - Unauthenticated Stored Cross-Site Scripting via Consent Field Hidden Input 0.2%
• CVE-2026-4394 Medium 6.1 Gravity Forms <= 2.9.30 - Unauthenticated Stored Cross-Site Scripting via Credit Card 'Card Type' Sub-Field 0.3%
• CVE-2026-4406 Medium 4.7 Gravity Forms <= 2.9.30 - Reflected Cross-Site Scripting via 'form_ids' Parameter 0.4%
• CVE-2026-3492 Medium 6.4 Gravity Forms <= 2.9.28.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Form Title 0.2%
• CVE-2025-12974 High 8.1 Gravity Forms <= 2.9.21.1 - Unauthenticated Arbitrary File Upload via Legacy Chunked Upload 0.7%
• CVE-2025-12352 Critical 9.8 Gravity Forms <= 2.9.20 - Unauthenticated Arbitrary File Upload via 'copy_post_image' 1.1%
• CVE-2024-13845 Medium 5.5 Gravity Forms WebHooks <= 1.6.0 - Authenticated (Admin+) Server-Side Request Forgery via Webhook 0.3%
• CVE-2024-13378 Medium 5.4 GravityForms 2.9.0.1 - 2.9.1.3 - Unauthenticated Stored Cross-Site Scripting via 'style_settings' parameter 0.3%
• CVE-2024-13377 High 7.2 GravityForms <= 2.9.1.3 - Unauthenticated Stored Cross-Site Scripting via 'alt' parameter 0.3%