CVE-2026-4406

Gravity Forms = 2.9.28 — Неаутентифицированный отражённый межсайтовый скриптинг через параметр formids в gformgetconfig Сводка об уязвимости Поле| Значение ---|--- Затронутое ПО| Gravity Forms плагин WordPress Вендор| Rocketgenius, Inc. Тип уязвимости| CWE-79: Некорректная нейтрализация входных...

CVE-2026-4406

The Gravity Forms plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the formids parameter in the gformgetconfig AJAX action in all versions up to, and including, 2.9.30. This is due to the GFCommon::sendjson method outputting JSON-encoded data wrapped in HTML comment...

CVE-2026-4406: Improper Neutralization of Input During Web Page Generation

The Gravity Forms plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the formids parameter in the gformgetconfig AJAX action in all versions up to, and including, 2.9.30. This is due to the GFCommon::sendjson method outputting JSON-encoded data wrapped in HTML comment...