Gravity Forms vulnerabilities

Products

• Forms 23

Newest

• gravity forms forms Gravity Forms <= 3.1.2 - Unauthenticated PHP Object Injection via Post Custom Field CVE-2026-103039 Public exploit 9.8 CriticalOctober 30, 2026
• gravity forms forms Gravity Forms <= 3.1.2 - Unauthenticated Stored Cross-Site Scripting via List Field CVE-2026-97645 7.2 HighOctober 30, 2026
• gravity forms forms Gravity Forms <= 3.1.1 - Unauthenticated Stored Cross-Site Scripting via Post Excerpt / Post Custom Field / Rich-Text Paragraph Field Values CVE-2026-90437 7.2 HighOctober 30, 2026
• gravity forms forms, rocketgenius, inc gravity forms +1 more WordPress Gravity Forms plugin < 3.1.1 - PHP Object Injection vulnerability CVE-2026-97296 8.1 HighOctober 16, 2026
• gravity forms forms Gravity Forms <= 3.1.0.4 - Unauthenticated Arbitrary File Upload via Hidden File Upload Field CVE-2026-84434 Public exploit 9.8 CriticalSeptember 19, 2026
• gravity forms forms Gravity Forms <= 2.10.5 - Unauthenticated Stored Cross-Site Scripting via Post Body Field Value CVE-2026-16649 7.2 HighSeptember 5, 2026
• gravity forms forms Gravity Forms <= 3.0.2 - Unauthenticated Arbitrary File Upload via State/Chunk Hash Confusion CVE-2026-19513 8.1 HighSeptember 1, 2026
• gravity forms forms Gravity Forms <= 2.10.4 - Unauthenticated Arbitrary File Read via 'gform_uploaded_files' Parameter CVE-2026-12997 7.5 HighJuly 15, 2026
• gravity forms forms, rocketgenius inc. gravity forms +1 more WordPress Gravity Forms plugin <= 2.10.0.1 - Arbitrary File Deletion vulnerability CVE-2026-48866 Public exploit 9.6 CriticalJune 1, 2026
• gravity forms forms Gravity Forms <= 2.10.0 - Unauthenticated Stored Cross-Site Scripting via Single Product Field Inside Repeater CVE-2026-5110 7.2 HighMay 2, 2026
• gravity forms forms Gravity Forms <= 2.10.0 - Unauthenticated Stored Cross-Site Scripting via Hidden Product Field in Repeater CVE-2026-5111 7.2 HighMay 2, 2026
• gravity forms forms Gravity Forms <= 2.10.0 - Unauthenticated Stored Cross-Site Scripting via Product Option CVE-2026-5109 7.2 HighMay 2, 2026
• gravity forms forms Gravity Forms <= 2.10.0 - Unauthenticated Stored Cross-Site Scripting via Consent Field Hidden Input CVE-2026-5113 7.2 HighMay 2, 2026
• gravity forms forms Gravity Forms <= 2.10.0 - Unauthenticated Stored Cross-Site Scripting via Calculation Product Field in Repeater CVE-2026-5112 7.2 HighMay 2, 2026
• gravity forms forms Gravity Forms <= 2.9.30 - Unauthenticated Stored Cross-Site Scripting via Credit Card 'Card Type' Sub-Field CVE-2026-4394 6.1 MediumApril 7, 2026
• gravity forms forms Gravity Forms <= 2.9.30 - Reflected Cross-Site Scripting via 'form_ids' Parameter CVE-2026-4406 Public exploit 4.7 MediumApril 7, 2026
• gravity forms forms Gravity Forms <= 2.9.28.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Form Title CVE-2026-3492 6.4 MediumMarch 11, 2026
• gravity forms forms, unknown gravity forms +1 more GravityForms < 2.9.23.1 - Unauthenticated Arbitrary File Upload CVE-2025-13407 Public exploit 6.8 MediumDecember 24, 2025
• gravity forms forms Gravity Forms <= 2.9.21.1 - Unauthenticated Arbitrary File Upload via Legacy Chunked Upload CVE-2025-12974 8.1 HighNovember 18, 2025
• gravity forms forms Gravity Forms <= 2.9.20 - Unauthenticated Arbitrary File Upload via 'copy_post_image' CVE-2025-12352 9.8 CriticalNovember 7, 2025
• gravity forms webhooks, rocketgenius gravity forms webhooks +1 more Gravity Forms WebHooks <= 1.6.0 - Authenticated (Admin+) Server-Side Request Forgery via Webhook CVE-2024-13845 5.5 MediumMay 1, 2025
• gravity forms forms GravityForms 2.9.0.1 - 2.9.1.3 - Unauthenticated Stored Cross-Site Scripting via 'style_settings' parameter CVE-2024-13378 5.4 MediumJanuary 17, 2025
• gravity forms forms GravityForms <= 2.9.1.3 - Unauthenticated Stored Cross-Site Scripting via 'alt' parameter CVE-2024-13377 7.2 HighJanuary 17, 2025
• gravity forms forms, gravityforms gravity forms +1 more WordPress Gravity Forms Plugin <= 2.7.3 is vulnerable to PHP Object Injection CVE-2023-28782 8.3 HighDecember 20, 2023