CVE-2026-5109: Gravity Forms <= 2.10.0 - Unauthenticated Stored Cross-Site Scripting via Product Option
The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 2.10.0. This is due to insufficient validation and output escaping of Product Option field values. The vulnerability exists because the state validation function accepts submitted values where the wpkses()-sanitized version matches a legitimate option value, but then stores the raw unsanitized value in the database. When administrators view entry details via the Order Summary section, the optionlabel is output directly without escaping (view-order-summary.php line 32), executing the injected JavaScript. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in entry data that will execute whenever an administrator accesses the entry details page.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-5109?
The severity of CVE-2026-5109 is considered high due to the potential for unauthenticated stored cross-site scripting.
How do I fix CVE-2026-5109?
To fix CVE-2026-5109, update the Gravity Forms plugin to version 2.10.1 or higher.
Which versions of Gravity Forms are affected by CVE-2026-5109?
Gravity Forms versions up to and including 2.10.0 are affected by CVE-2026-5109.
What attack vector is exploited in CVE-2026-5109?
CVE-2026-5109 exploits an unauthenticated stored cross-site scripting vulnerability via the Product Option field.
Can CVE-2026-5109 impact website security?
Yes, CVE-2026-5109 can significantly impact website security by allowing attackers to execute malicious scripts in a user's browser.