gravity-forms

Top products

The 15 most recently published vulnerabilities affecting gravity-forms.

• CVE-2026-16649Gravity Forms <= 2.10.5 - Unauthenticated Stored Cross-Site Scripting via Post Body Field Value7.2Sep 5, 2026
• CVE-2026-19513Gravity Forms <= 3.0.2 - Unauthenticated Arbitrary File Upload via State/Chunk Hash Confusion8.1Sep 1, 2026
• CVE-2026-12997Gravity Forms <= 2.10.4 - Unauthenticated Arbitrary File Read via 'gform_uploaded_files' Parameter7.5Jul 15, 2026
• CVE-2026-5110Gravity Forms <= 2.10.0 - Unauthenticated Stored Cross-Site Scripting via Single Product Field Inside Repeater7.2May 2, 2026
• CVE-2026-5111Gravity Forms <= 2.10.0 - Unauthenticated Stored Cross-Site Scripting via Hidden Product Field in Repeater7.2May 2, 2026
• CVE-2026-5109Gravity Forms <= 2.10.0 - Unauthenticated Stored Cross-Site Scripting via Product Option7.2May 2, 2026
• CVE-2026-5113Gravity Forms <= 2.10.0 - Unauthenticated Stored Cross-Site Scripting via Consent Field Hidden Input7.2May 2, 2026
• CVE-2026-5112Gravity Forms <= 2.10.0 - Unauthenticated Stored Cross-Site Scripting via Calculation Product Field in Repeater7.2May 2, 2026
• CVE-2026-4394Gravity Forms <= 2.9.30 - Unauthenticated Stored Cross-Site Scripting via Credit Card 'Card Type' Sub-Field6.1Apr 7, 2026
• CVE-2026-4406Gravity Forms <= 2.9.30 - Reflected Cross-Site Scripting via 'form_ids' Parameter4.7Apr 7, 2026
• CVE-2026-3492Gravity Forms <= 2.9.28.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Form Title6.4Mar 11, 2026
• CVE-2025-12974Gravity Forms <= 2.9.21.1 - Unauthenticated Arbitrary File Upload via Legacy Chunked Upload8.1Nov 18, 2025
• CVE-2025-12352Gravity Forms <= 2.9.20 - Unauthenticated Arbitrary File Upload via 'copy_post_image'9.8Nov 7, 2025
• CVE-2024-13845Gravity Forms WebHooks <= 1.6.0 - Authenticated (Admin+) Server-Side Request Forgery via Webhook5.5May 1, 2025
• CVE-2024-13378GravityForms 2.9.0.1 - 2.9.1.3 - Unauthenticated Stored Cross-Site Scripting via 'style_settings' parameter5.4Jan 17, 2025