Gravity Forms stored Cross-Site Scripting (XSS) vulnerability in the survey feature

2022-05-2417:39:34

Google

osv.dev

5.4 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

29.3%

JSON

A stored Cross-Site Scripting (XSS) vulnerability in the survey feature in Rocketgenius Gravity Forms before 2.4.21 allows remote attackers to inject arbitrary web script or HTML via a textarea field. This code is interpreted by users in a privileged role (Administrator, Editor, etc.).

CPENameOperatorVersion
wp-premium/gravityformseq2.4.9
wp-premium/gravityformseq2.4.17
wp-premium/gravityformseq2.4.11
wp-premium/gravityformseq2.4.12
wp-premium/gravityformseq2.4.20
wp-premium/gravityformseq2.4.10
wp-premium/gravityformseq2.4.7.3
wp-premium/gravityformseq2.4.8
wp-premium/gravityformseq2.4.16
wp-premium/gravityformseq2.4.5

Name	Operator	Version
wp-premium/gravityforms	eq	2.4.9
wp-premium/gravityforms	eq	2.4.17
wp-premium/gravityforms	eq	2.4.11
wp-premium/gravityforms	eq	2.4.12
wp-premium/gravityforms	eq	2.4.20
wp-premium/gravityforms	eq	2.4.10
wp-premium/gravityforms	eq	2.4.7.3
wp-premium/gravityforms	eq	2.4.8
wp-premium/gravityforms	eq	2.4.16
wp-premium/gravityforms	eq	2.4.5