Import Excel to Gravity Forms
Import Excel to Gravity Forms has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it is fixed as of September 2026. Their average CVSS score is 7.1, and the most serious one scores 7.1 out of 10. Severity breakdown: 0 critical and 1 high.
The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).
The one issue recorded for Import Excel to Gravity Forms has a vendor fix available, so running the current release closes it.
All of these findings were reported by Le Ngoc Anh. Import Excel to Gravity Forms is installed on roughly 100 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.7.7.
CVE-2025-24629Import Excel to Gravity Forms <= 1.18 - Reflected Cross-Site Scripting
Read the full analysisVulnerability Records

Import Excel to Gravity Forms
Author
wpgear
An easy and convenient way to bulk load and process large numbers of records in GF forms. Each record is checked for compatibility of field formats before saving. If you have a Form in which there are Calculated Fields based on the Values of other Fields and the need for bulk import of source data, then this Plugin will definitely be useful to you. For example. Form Type Calculator: Field id=2 “A”: Term 1. Field id=3 “B”: Term 2. Field id=5 “Ratio”: Coefficient. Field “Calc”: C = (A + B) * Ratio When Importing Records, you usually need to prepare all the Values of all Fields: A; B; Ratio; C. So, to carry out preliminary calculations. Difficulties begin when branched Inner Logic is used. When there are various additional Fields for selecting conditions in the form of Lists, Options. (“Gravity Forms” allows you to use both built-in Internal Logic in each of the Fields, and connect JS Scripts with Scripts.) Transferring JS Scripts with Scripts to an Excel-prepared Table can be quite a difficult task. Errors are almost inevitable. Moreover, it is necessary to carefully maintain the correspondence of the calculated formulas in the Table with the Form Algorithms. And if you have changed something in the algorithms of the Form, then you again need to change and then test the Formulas in the Table. Even writing about it is tiresome. Moreover, some Field Values may have both Value and Format Constraints. In normal cases, import without checking such Restrictions may lead to an abnormal termination of the Import process, or to incorrectly filled Fields. In any case, manual correction of Records after such an Import can be costly and resource intensive. It is for such Tasks that this Plugin is needed. It is enough to fill in only the Initial Fields. In our Example – Fields: A B and Ratio. Calculated Field “C” will be calculated in each imported Record by the internal Form algorithms and will be saved. If some of the Values are out of range, then such a Record will not be saved and will require correction directly during the Import process. You can watch and try the Demo on a real Form. Features Works with PHP 7.4 Works with Gravity Forms versions 2.3.3.4 and higher. Tested up to 2.8.17 Import entries are lines of a text file (usually CSV) separated by commas. You can choose any other separator. You can navigate through the list of imported records and save only a few of them. Each record is checked for compatibility of field formats before saving. If the Form Fields have internal logic, then each record is processed with this logic in mind before being saved. All types of fields are imported: “Text”, “TextArea”, “Number”, “Date”, “Email”, “Select”, “MultiSelect”, “Radio”, “CheckBox”. Each Form has its own option “Import Enable”. Works correctly with Cyrillic and other National character encodings. Each Form has its own “Import Enable” option. Works correctly when there are several other GForms on the page. Possibility to choose encoding of CSV file: ‘utf-8’ – default; ‘ISO-8859-1’; ‘CP1251’; etc… PRO Version Features: Ability to select data type (Name / Value) for Fields: “Select”, “MultiSelect”, “Radio”, “CheckBox”. Generation of a Template for easy filling of the Import Table. Template – Excel file in XLSX format. The Template contains: Field IDs, Fields Name, Type and Prompts for input. Input Prompts contain all Valid Variants for a given Field, given the selected data type (Name / Value). Installation Upload ‘gf-excel-import’ folder to the ‘/wp-content/plugins/’ directory. Activate the plugin through the ‘Plugins’ menu in WordPress. If you have any problems – please ask for support. Sample: In the “gf-excel-import/sample” folder there is a sample CSV file (sample-csv-data-import.csv) and an example Form (samle-gf-form.json). The form should be imported using Gravity Forms tools.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C