WordSec
WordSec

Gravity Forms

Explore Gravity Forms vulnerabilities across all versions. Currently tracking 23 known vulnerabilities, including severity, impact, and patch status.

01234567891026.02.2015Today26.02.20159.8Gravityforms <= 1.8.19 - Arbitrary File Upload CVSS 9.8 · 26.02.201517.03.20159.1Gravityforms <= 1.9.3.5 - SQL Injection CVSS 9.1 · 17.03.201520.04.20155.4Gravityforms <= 1.9.6 - Cross-Site Scripting CVSS 5.4 · 20.04.201501.03.20164.7Gravityforms <= 1.9.15.11 - Cross-Site Scripting CVSS 4.7 · 01.03.201607.09.20165.4Gravity Forms <= 2.0.6.5 - Cross-Site Scripting CVSS 5.4 · 07.09.201608.05.20197.5Gravityforms <= 2.4.8 - Information Exposure CVSS 7.5 · 08.05.201929.05.20239.8Gravity Forms <= 2.7.3 - Unauthenticated PHP Object Injection CVSS 9.8 · 29.05.202321.06.20236.1Gravity Forms <= 2.7.4 - Reflected Cross-Site Scripting CVSS 6.1 · 21.06.202316.01.20257.2GravityForms <= 2.9.1.3 - Unauthenticated Stored Cross-Site Scripting via 'alt' parameter CVSS 7.2 · 16.01.20255.4GravityForms 2.9.0.1 - 2.9.1.3 - Unauthenticated Stored Cross-Site Scripting via 'style_settings' parameter CVSS 5.4 · 16.01.202506.11.20259.8Gravity Forms <= 2.9.20 - Unauthenticated Arbitrary File Upload via 'copy_post_image' CVSS 9.8 · 06.11.202517.11.20258.1Gravity Forms <= 2.9.21.1 - Unauthenticated Arbitrary File Upload via Legacy Chunked Upload CVSS 8.1 · 17.11.202503.12.20259.8Gravity Forms <= 2.9.23.0 - Unauthenticated Arbitrary File Upload CVSS 9.8 · 03.12.202510.03.20266.4Gravity Forms <= 2.9.28.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Form Title CVSS 6.4 · 10.03.202607.04.20264.7Gravity Forms <= 2.9.30 - Reflected Cross-Site Scripting via 'form_ids' Parameter CVSS 4.7 · 07.04.20266.1Gravity Forms <= 2.9.30 - Unauthenticated Stored Cross-Site Scripting via Credit Card 'Card Type' Sub-Field CVSS 6.1 · 07.04.202601.05.20267.2Gravity Forms <= 2.10.0 - Unauthenticated Stored Cross-Site Scripting via Single Product Field Inside Repeater CVSS 7.2 · 01.05.20267.2Gravity Forms <= 2.10.0 - Unauthenticated Stored Cross-Site Scripting via Hidden Product Field in Repeater CVSS 7.2 · 01.05.20267.2Gravity Forms <= 2.10.0 - Unauthenticated Stored Cross-Site Scripting via Product Option CVSS 7.2 · 01.05.20267.2Gravity Forms <= 2.10.0 - Unauthenticated Stored Cross-Site Scripting via Calculation Product Field in Repeater CVSS 7.2 · 01.05.20267.2Gravity Forms <= 2.9.30 - Unauthenticated Stored Cross-Site Scripting via Consent Field Hidden Input CVSS 7.2 · 01.05.202601.06.20269.1Gravity Forms <= 2.10.0.1 - Unauthenticated Arbitrary File Deletion CVSS 9.1 · 01.06.202615.07.20267.5Gravity Forms <= 2.10.4 - Unauthenticated Arbitrary File Read via 'gform_uploaded_files' Parameter CVSS 7.5 · 15.07.2026

Strategic Overview

Avg CVSSHigh
7.3/ 10
Patch Coverage100%
Open

0

Fixed

23

Get automatic notifications for all Gravity Forms vulnerabilities before they are exploited.

Vulnerability Records

23 records
2026-07-15 06:20
Gravity Forms <= 2.10.4 - Unauthenticated Arbitrary File Read via 'gform_uploaded_files' Parameter
Gravity Forms
<= 2.10.4
CVE-2026-12997
7.5
High
darooYes
2026-06-01 00:00
Gravity Forms <= 2.10.0.1 - Unauthenticated Arbitrary File Deletion
Gravity Forms
<= 2.10.0.1
CVE-2026-48866
9.1
Critical
darooYes
2026-05-01 00:00
Gravity Forms <= 2.10.0 - Unauthenticated Stored Cross-Site Scripting via Single Product Field Inside Repeater
Gravity Forms
<= 2.10.0
CVE-2026-5110
7.2
High
Luc Huynh from Noventiq RedTeamYes
2026-05-01 00:00
Gravity Forms <= 2.10.0 - Unauthenticated Stored Cross-Site Scripting via Hidden Product Field in Repeater
Gravity Forms
<= 2.10.0
CVE-2026-5111
7.2
High
Luc Huynh from Noventiq RedTeamYes
2026-05-01 00:00
Gravity Forms <= 2.10.0 - Unauthenticated Stored Cross-Site Scripting via Product Option
Gravity Forms
<= 2.10.0
CVE-2026-5109
7.2
High
Luc Huynh from Noventiq RedTeamYes
2026-05-01 00:00
Gravity Forms <= 2.10.0 - Unauthenticated Stored Cross-Site Scripting via Calculation Product Field in Repeater
Gravity Forms
<= 2.10.0
CVE-2026-5112
7.2
High
Luc Huynh from Noventiq RedTeamYes
2026-05-01 00:00
Gravity Forms <= 2.9.30 - Unauthenticated Stored Cross-Site Scripting via Consent Field Hidden Input
Gravity Forms
<= 2.9.30
CVE-2026-5113
7.2
High
Luc Huynh from Noventiq RedTeamYes
2026-04-07 10:47
Gravity Forms <= 2.9.30 - Unauthenticated Stored Cross-Site Scripting via Credit Card 'Card Type' Sub-Field
Gravity Forms
<= 2.9.30
CVE-2026-4394
6.1
Medium
Luc Huynh from Noventiq RedTeamYes
2026-04-07 10:36
Gravity Forms <= 2.9.30 - Reflected Cross-Site Scripting via 'form_ids' Parameter
Gravity Forms
<= 2.9.30
CVE-2026-4406
4.7
Medium
Anthony Cihan (Hann1bl3L3ct3r)Yes
2026-03-10 21:09
Gravity Forms <= 2.9.28.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Form Title
Gravity Forms
<= 2.9.28
CVE-2026-3492
6.4
Medium
h0xiloYes
Showing 1–10 of 23 reports

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C