CVE-2026-4394: Gravity Forms <= 2.9.30 - Unauthenticated Stored Cross-Site Scripting via Credit Card 'Card Type' Sub-Field
The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Credit Card field's 'Card Type' sub-field (input<id>.4) in all versions up to, and including, 2.9.30. This is due to the getvalueentrydetail() method in the GFFieldCreditCard class outputting the card type value without escaping, combined with getvaluesaveentry() accepting and storing unsanitized user input for the input<id>.4 parameter. The Card Type field is not rendered on the frontend form (it is normally derived from the card number), but the backend submission parser blindly accepts it if included in the POST request. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute when an administrator views the form entry in the WordPress dashboard.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Gravity Forms (WordPress plugin)to a version that resolves this vulnerability.Fixed in 2.9.30
Event History
Frequently Asked Questions
What is the severity of CVE-2026-4394?
CVE-2026-4394 is a medium severity vulnerability due to its potential for stored cross-site scripting.
How do I fix CVE-2026-4394?
To fix CVE-2026-4394, update the Gravity Forms plugin to a version greater than 2.9.30.
What versions are affected by CVE-2026-4394?
CVE-2026-4394 affects all versions of Gravity Forms up to and including 2.9.30.
What type of vulnerability is CVE-2026-4394?
CVE-2026-4394 is classified as an unauthenticated stored cross-site scripting vulnerability.
How was CVE-2026-4394 discovered?
CVE-2026-4394 was discovered through the analysis of the Credit Card field's sub-field in the Gravity Forms plugin.