Skip to content
OpenAdvisories

Vendor

Gravity Forms

20 known vulnerabilities.

Products

Gravity Forms 19 Gravity Forms WebHooks 1
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-103039 Public exploit

    Gravity Forms <= 3.1.2 - Unauthenticated PHP Object Injection via Post Custom Field

    The Gravity Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.1.2 via a Post Custom Field whose input type is List. This is due to GFFormsModel::create_post() passing the submitted value to WordPress' unr…

    Gravity Forms Gravity Forms Web / CMS
  • Critical 9.8
    CVE-2026-84434 Public exploit

    Gravity Forms <= 3.1.0.4 - Unauthenticated Arbitrary File Upload via Hidden File Upload Field

    The Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.1.0.4 via the upload_file function. This is due to a mismatch between the field validation pipeline and the file persistence pipeline, where …

    Gravity Forms Gravity Forms Web / CMS
  • Medium 4.7
    CVE-2026-4406 Public exploit

    Gravity Forms <= 2.9.30 - Reflected Cross-Site Scripting via 'form_ids' Parameter

    The Gravity Forms plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `form_ids` parameter in the `gform_get_config` AJAX action in all versions up to, and including, 2.9.30. This is due to the `GFCommon::send_json()` method outputtin…

    Gravity Forms Gravity Forms Web / CMS