Gravity Forms WordPress plugin stored XSS flaw listed as EUVD-2026-113735
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- Gravity Forms
- Product
- Gravity Forms
- First seen
Summary
An EUVD entry (EUVD-2026-113735, CVSS v3.1 7.2) says the Gravity Forms WordPress plugin is vulnerable to stored cross-site scripting in all versions up to and including 3.1.1. The item attributes the issue to insufficient input sanitization and output escaping.
If you use Gravity Forms
Update Gravity Forms to a version later than 3.1.1
Review form field values for unexpected script content
Restrict form editing to trusted administrators
Update Gravity Forms to a version later than 3.1.2
Review List field entries for injected script content
Update Gravity Forms to a version later than 3.1.2 immediately
What the sources say 3
· Mastodon: “The Gravity Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.1.2 via a Post Custom Field whose input type is List.” Source
· Mastodon: “The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via List Field in all versions up to, and including, 3.1.2 due to insufficient input sanitization and output escaping.” Source
· Mastodon: “The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Post Excerpt / Post Custom Field / Rich-Text Paragraph Field Values in all versions up to, and including, 3.1.1 due to insufficient input sanitization and o” Source