Skip to content
OpenAdvisories

Vendor

Gravity Forms

20 known vulnerabilities.

Products

Gravity Forms 19 Gravity Forms WebHooks 1
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-103039 Public exploit

    Gravity Forms <= 3.1.2 - Unauthenticated PHP Object Injection via Post Custom Field

    The Gravity Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.1.2 via a Post Custom Field whose input type is List. This is due to GFFormsModel::create_post() passing the submitted value to WordPress' unr…

    Gravity Forms Gravity Forms Web / CMS
  • Critical 9.8
    CVE-2026-84434 Public exploit

    Gravity Forms <= 3.1.0.4 - Unauthenticated Arbitrary File Upload via Hidden File Upload Field

    The Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.1.0.4 via the upload_file function. This is due to a mismatch between the field validation pipeline and the file persistence pipeline, where …

    Gravity Forms Gravity Forms Web / CMS
  • Critical 9.8
    CVE-2025-12352

    Gravity Forms <= 2.9.20 - Unauthenticated Arbitrary File Upload via 'copy_post_image'

    The Gravity Forms plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the copy_post_image() function in all versions up to, and including, 2.9.20. This makes it possible for unauthenticated attackers to upload a…

    Gravity Forms Gravity Forms Web / CMS