CVE-2024-0710

CVE-2024-0710 Уязвимость: CVE-2024-0710 Неавторизованное изменение уникального идентификатора отправки формы CVSS: 5.3 Средний Программное обеспечение: GP Unique ID gp-unique-id Затронутые версии: = 1.5.5 Исправленная версия: 1.5.6 Разработчик: Gravity Wiz Исследователь: Karl Emil Nikka, Nikka...

WordPress Gravity Forms Plugin <=3.1.0.4 - Unauthenticated Arbitrary File Upload

Gravity Forms WordPress plugin version 3.1.0.4 and earlier contains an unauthenticated arbitrary file upload vulnerability caused by bypassing extension validation in hidden file upload fields. Unauthenticated attackers can upload any file type including PHP when a form has a File Upload field...

Infusionsoft Gravity Forms Add-on < 1.5.7 - Cross-Site Scripting

Multiple cross-site scripting vulnerabilities in tests/notAutotestContactServicepauseCampaign.php in the Infusionsoft Gravity Forms plugin before 1.5.6 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 go, 2 contactId, or 3 campaignId parameter. id: CVE-2014-45...

CVE-2026-48866

php // deletephysicalfile — WITH validation $filepath = self::getphysicalfilepath $url, $entryid ; $filepath = applyfilters 'gformfilepathpredeletefile', $filepath, $url ; // NEW: verify path is in uploads if ! GFCommon::isfileinuploads$url GFCommon::logdebugMETHOD . sprintf': Not deleting: %s',...

CVE-2026-84434

CVE-2026-84434 — Gravity Forms 인증되지 않은 임의 파일 업로드 Gravity Forms 의 CVE-2026-84434에 대한 Python 3 PoC 스캐너 및 익스플로잇입니다. | ---|--- 플러그인| gravityforms 영향받는 버전| ≤ 3.1.0.4 수정된 버전| 3.1.0.5+ 벤더 보안 릴리스 3.1.1 CVSS| 9.8 치명적 인증| 인증 불필요 CWE| CWE-434 — 제한 없는 업로드 공로| 0xd4rk5id3 — EnvoraSec Wordfence 요약 숨겨진 File Uplo...

CVE-2026-84434

The Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.1.0.4 via the uploadfile function. This is due to a mismatch between the field validation pipeline and the file persistence pipeline, where hidden file upload fields bypass...

CVE-2026-84434 Gravity Forms <= 3.1.0.4 - Unauthenticated Arbitrary File Upload via Hidden File Upload Field

The Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.1.0.4 via the uploadfile function. This is due to a mismatch between the field validation pipeline and the file persistence pipeline, where hidden file upload fields bypass...

EUVD-2026-83472

The Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.1.0.4 via the uploadfile function. This is due to a mismatch between the field validation pipeline and the file persistence pipeline, where hidden file upload fields bypass...

CVE-2026-84434

Gravity Forms (WordPress plugin) is vulnerable to unauthenticated arbitrary file upload in all versions up to and including 3.1.0.4 . The root cause is a mismatch between the field validation pipeline and the file persistence pipeline: hidden file upload fields bypass extension validation, and a ...

WordPress Gravity Forms plugin <= 3.1.0.4 - Unauthenticated Arbitrary File Upload via Hidden File Upload Field vulnerability

Unauthenticated Arbitrary File Upload via Hidden File Upload Field vulnerability discovered by 0xd4rk5id3 - EnvoraSec in WordPress Plugin Gravity Forms versions = 3.1.0.4...

CVE-2026-87796

abraxaslabs.tech · github.com/abraxas · @abraxasnull · CVE-2026-87796 CVE-2026-87796 Multi Uploader for Gravity Forms 1.1.9 — sh1zen WordPress 用 Multi Uploader for Gravity Forms プラグインは、movefile 関数を介して 1.1.9...

VulnCheck KEV: CVE-2026-84434

The Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.1.0.4 via the uploadfile function. This is due to a mismatch between the field validation pipeline and the file persistence pipeline, where hidden file upload fields bypass...

CVE-2026-87796

The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.1.9 via the movefile function. This is due to insufficient file type validation during chunked upload handling. This makes it possible for unauthenticated...

CVE-2026-87796 Multi Uploader for Gravity Forms <= 1.1.9 - Unauthenticated Arbitrary File Upload via Chunked File Upload

The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.1.9 via the movefile function. This is due to insufficient file type validation during chunked upload handling. This makes it possible for unauthenticated...

EUVD-2026-81335

The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.1.9 via the movefile function. This is due to insufficient file type validation during chunked upload handling. This makes it possible for unauthenticated...

CVE-2026-87796

The Multi Uploader for Gravity Forms WordPress plugin is vulnerable to unauthenticated arbitrary file upload in all versions up to and including 1.1.9 . The flaw resides in the move_file function in GFMU_FileUploader.php, where insufficient file type validation during chunked upload handling allo...

CVE-2026-4406

Gravity Forms = 2.9.28 — gformgetconfig formids 매개변수를 통한 인증되지 않은 반사형 크로스사이트 스크립팅 취약점 요약 "success":true,"data":"common":"form":"pagination":"":null "success":true,"data":"common":"form":"pagination":"":null,"":null...

WordPress Multi Uploader for Gravity Forms plugin <= 1.1.9 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by Adam Rayyan Aryasatya in WordPress Plugin Multi Uploader for Gravity Forms versions = 1.1.9...

CVE-2026-77773

CVE-2026-77773 affects the Contact Form to Chat Apps | Click to Chat to Order (FormyChat) WordPress plugin before 2.15.8 . The root cause is a missing capability, nonce, or session check on the public AJAX action formychat_get_gf_entry , allowing unauthenticated users to read submitted entries fr...

CVE-2026-77773 Social Contact Form (FormyChat) < 2.15.8 - Unauthenticated Gravity Forms Entry Disclosure via formychat_get_gf_entry

The Contact Form to Chat Apps | Click to Chat to Order WordPress plugin before 2.15.8 does not perform any capability, nonce or session check on one of its public AJAX actions, allowing unauthenticated users to read the submitted entries of any form created with a supported third-party form Conta...