CVE-2026-4406

Gravity Forms = 2.9.28 — Cross-Site Scripting Riflesso Non Autenticato tramite il Parametro formids di gformgetconfig Riepilogo della Vulnerabilità "success":true,"data":"common":"form":"pagination":"":null "success":true,"data":"common":"form":"pagination":"":null,"":null...

CVE-2026-4406

The Gravity Forms plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the formids parameter in the gformgetconfig AJAX action in all versions up to, and including, 2.9.30. This is due to the GFCommon::sendjson method outputting JSON-encoded data wrapped in HTML comment...