Gravity Forms

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Plugins   >   Gravity Forms

Information

Software Type Plugin
Software Slug gravityforms
Software Status Removed
Software Author Gravity Forms
Software Website www.gravityforms.com
Software Active Installs 1,000,000
Software Record Last Updated March 16, 2026

Showing 1-20 of 23 Vulnerabilities

Submit a Vulnerability
Gravity Forms <= 2.10.4 - Unauthenticated Arbitrary File Read via 'gform_uploaded_files' Parameter
7.5
CVE-2026-12997
Jul 15, 2026
Researcher: daroo
Gravity Forms <= 2.10.0.1 - Unauthenticated Arbitrary File Deletion
9.1
CVE-2026-48866
Jun 1, 2026
Researcher: daroo
Gravity Forms <= 2.10.0 - Unauthenticated Stored Cross-Site Scripting via Calculation Product Field in Repeater
7.2
CVE-2026-5112
May 1, 2026
Researcher: Luc Huynh from Noventiq RedTeam
Gravity Forms <= 2.10.0 - Unauthenticated Stored Cross-Site Scripting via Hidden Product Field in Repeater
7.2
CVE-2026-5111
May 1, 2026
Researcher: Luc Huynh from Noventiq RedTeam
Gravity Forms <= 2.10.0 - Unauthenticated Stored Cross-Site Scripting via Single Product Field Inside Repeater
7.2
CVE-2026-5110
May 1, 2026
Researcher: Luc Huynh from Noventiq RedTeam
Gravity Forms <= 2.9.30 - Unauthenticated Stored Cross-Site Scripting via Consent Field Hidden Input
7.2
CVE-2026-5113
May 1, 2026
Researcher: Luc Huynh from Noventiq RedTeam
Gravity Forms <= 2.10.0 - Unauthenticated Stored Cross-Site Scripting via Product Option
7.2
CVE-2026-5109
May 1, 2026
Researcher: Luc Huynh from Noventiq RedTeam
Gravity Forms <= 2.9.30 - Unauthenticated Stored Cross-Site Scripting via Credit Card 'Card Type' Sub-Field
6.1
CVE-2026-4394
Apr 7, 2026
Researcher: Luc Huynh from Noventiq RedTeam
Gravity Forms <= 2.9.30 - Reflected Cross-Site Scripting via 'form_ids' Parameter
4.7
CVE-2026-4406
Apr 7, 2026
Researcher: Anthony Cihan (Hann1bl3L3ct3r)
Gravity Forms <= 2.9.28.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Form Title
6.4
CVE-2026-3492
Mar 10, 2026
Researcher: h0xilo
Gravity Forms <= 2.9.23.0 - Unauthenticated Arbitrary File Upload
9.8
CVE-2025-13407
Dec 3, 2025
Researchers:
Gravity Forms <= 2.9.21.1 - Unauthenticated Arbitrary File Upload via Legacy Chunked Upload
8.1
CVE-2025-12974
Nov 17, 2025
Researcher: Talal Nasraddeen
Gravity Forms <= 2.9.20 - Unauthenticated Arbitrary File Upload via 'copy_post_image'
9.8
CVE-2025-12352
Nov 6, 2025
Researcher: Talal Nasraddeen
GravityForms 2.9.0.1 - 2.9.1.3 - Unauthenticated Stored Cross-Site Scripting via 'style_settings' parameter
5.4
CVE-2024-13378
Jan 16, 2025
Researcher: mikemyers
GravityForms <= 2.9.1.3 - Unauthenticated Stored Cross-Site Scripting via 'alt' parameter
7.2
CVE-2024-13377
Jan 16, 2025
Researcher: mikemyers
Gravity Forms <= 2.7.4 - Reflected Cross-Site Scripting
6.1
CVE-2023-2701
Jun 21, 2023
Researcher: Fioravante Souza
Gravity Forms <= 2.7.3 - Unauthenticated PHP Object Injection
9.8
CVE-2023-28782
May 29, 2023
Researcher: Rafie Muhammad
Gravityforms <= 2.4.8 - Information Exposure
7.5
CVE-2020-13764
May 8, 2019
Researchers:
Gravity Forms <= 2.0.6.5 - Cross-Site Scripting
5.4
CVE ID Unknown
Sep 7, 2016
Researcher: c0mmand3rOpSec
Gravityforms <= 1.9.15.11 - Cross-Site Scripting
4.7
CVE ID Unknown
Mar 1, 2016
Researchers: Henri Salo (fgeek), Allan Collins
Title Status CVE ID CVSS Researchers Date
Gravity Forms <= 2.10.4 - Unauthenticated Arbitrary File Read via 'gform_uploaded_files' Parameter Patched CVE-2026-12997 7.5 daroo July 15, 2026
Gravity Forms <= 2.10.0.1 - Unauthenticated Arbitrary File Deletion Patched CVE-2026-48866 9.1 daroo June 1, 2026
Gravity Forms <= 2.10.0 - Unauthenticated Stored Cross-Site Scripting via Calculation Product Field in Repeater Patched CVE-2026-5112 7.2 Luc Huynh from Noventiq RedTeam May 1, 2026
Gravity Forms <= 2.10.0 - Unauthenticated Stored Cross-Site Scripting via Hidden Product Field in Repeater Patched CVE-2026-5111 7.2 Luc Huynh from Noventiq RedTeam May 1, 2026
Gravity Forms <= 2.10.0 - Unauthenticated Stored Cross-Site Scripting via Single Product Field Inside Repeater Patched CVE-2026-5110 7.2 Luc Huynh from Noventiq RedTeam May 1, 2026
Gravity Forms <= 2.9.30 - Unauthenticated Stored Cross-Site Scripting via Consent Field Hidden Input Patched CVE-2026-5113 7.2 Luc Huynh from Noventiq RedTeam May 1, 2026
Gravity Forms <= 2.10.0 - Unauthenticated Stored Cross-Site Scripting via Product Option Patched CVE-2026-5109 7.2 Luc Huynh from Noventiq RedTeam May 1, 2026
Gravity Forms <= 2.9.30 - Unauthenticated Stored Cross-Site Scripting via Credit Card 'Card Type' Sub-Field Patched CVE-2026-4394 6.1 Luc Huynh from Noventiq RedTeam April 7, 2026
Gravity Forms <= 2.9.30 - Reflected Cross-Site Scripting via 'form_ids' Parameter Patched CVE-2026-4406 4.7 Anthony Cihan (Hann1bl3L3ct3r) April 7, 2026
Gravity Forms <= 2.9.28.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Form Title Patched CVE-2026-3492 6.4 h0xilo March 10, 2026
Gravity Forms <= 2.9.23.0 - Unauthenticated Arbitrary File Upload Patched CVE-2025-13407 9.8 December 3, 2025
Gravity Forms <= 2.9.21.1 - Unauthenticated Arbitrary File Upload via Legacy Chunked Upload Patched CVE-2025-12974 8.1 Talal Nasraddeen November 17, 2025
Gravity Forms <= 2.9.20 - Unauthenticated Arbitrary File Upload via 'copy_post_image' Patched CVE-2025-12352 9.8 Talal Nasraddeen November 6, 2025
GravityForms 2.9.0.1 - 2.9.1.3 - Unauthenticated Stored Cross-Site Scripting via 'style_settings' parameter Patched CVE-2024-13378 5.4 mikemyers January 16, 2025
GravityForms <= 2.9.1.3 - Unauthenticated Stored Cross-Site Scripting via 'alt' parameter Patched CVE-2024-13377 7.2 mikemyers January 16, 2025
Gravity Forms <= 2.7.4 - Reflected Cross-Site Scripting Patched CVE-2023-2701 6.1 Fioravante Souza June 21, 2023
Gravity Forms <= 2.7.3 - Unauthenticated PHP Object Injection Patched CVE-2023-28782 9.8 Rafie Muhammad May 29, 2023
Gravityforms <= 2.4.8 - Information Exposure Patched CVE-2020-13764 7.5 May 8, 2019
Gravity Forms <= 2.0.6.5 - Cross-Site Scripting Patched 5.4 c0mmand3rOpSec September 7, 2016
Gravityforms <= 1.9.15.11 - Cross-Site Scripting Patched 4.7 Henri Salo (fgeek), Allan Collins March 1, 2016

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation