CVE-2026-12997 | High | 7.5 | 2026-07-15 | The Gravity Forms plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.10.4 via the 'gform_uploaded_files' paramet… |
CVE-2026-5113 | High | 7.2 | 2026-05-02 | The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Consent field hidden inputs in versions up to and including 2.10.0. Thi… |
CVE-2026-5112 | High | 7.2 | 2026-05-02 | The Gravity Forms plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting in versions up to and including 2.10.0. This is due to insu… |
CVE-2026-5111 | High | 7.2 | 2026-05-02 | The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 2.10.0. This is due to insufficient input v… |
CVE-2026-5110 | High | 7.2 | 2026-05-02 | The Gravity Forms plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting in versions up to and including 2.10.0. This is due to insu… |
CVE-2026-5109 | High | 7.2 | 2026-05-02 | The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 2.10.0. This is due to insufficient validat… |
CVE-2026-4406 | Medium | 4.7 | 2026-04-08 | The Gravity Forms plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `form_ids` parameter in the `gform_get_config` AJAX action in al… |
CVE-2026-4394 | Medium | 6.1 | 2026-04-08 | The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Credit Card field's 'Card Type' sub-field (`input_<id>.4`) in all v… |
CVE-2026-3492 | Medium | 6.4 | 2026-03-11 | The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.9.28.1. This is due to a compound f… |
CVE-2025-12974 | High | 8.1 | 2025-11-18 | The Gravity Forms plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the legacy chunked upload mechanism in al… |
CVE-2025-12352 | Critical | 9.8 | 2025-11-07 | The Gravity Forms plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the copy_post_image() function in all ver… |
CVE-2024-13845 | Medium | 5.5 | 2025-05-01 | The Gravity Forms WebHooks plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.6.0 via the 'process_feed'… |
CVE-2024-13378 | Medium | 5.4 | 2025-01-17 | The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘style_settings’ parameter in versions 2.9.0.1 up to, and including… |
CVE-2024-13377 | High | 7.2 | 2025-01-17 | The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘alt’ parameter in all versions up to, and including, 2.9.1.3 due t… |