1315 matches found
CVE-2026-48866
php // deletephysicalfile — WITH validation $filepath = self::getphysicalfilepath $url, $entryid ; $filepath = applyfilters 'gformfilepathpredeletefile', $filepath, $url ; // NEW: verify path is in uploads if ! GFCommon::isfileinuploads$url GFCommon::logdebugMETHOD . sprintf': Not del...
CVE-2024-0710
CVE-2024-0710 Vulnerabilità: CVE-2024-0710 Modifica non autenticata dell'ID univoco di invio del modulo CVSS: 5.3 Medio Software: GP Unique ID gp-unique-id Versioni interessate: = 1.5.5 Versione corretta: 1.5.6 Sviluppatore: Gravity Wiz Ricercatore: Karl Emil Nikka, Nikka Systems Pubblicato...
Gravity SMTP WordPress Plugin - Sensitive Information Exposure
Gravity SMTP WordPress plugin = 2.1.4 contains a sensitive information exposure caused by an unrestricted REST API endpoint at /wp-json/gravitysmtp/v1/tests/mock-data, letting unauthenticated attackers retrieve detailed system configuration data, exploit requires no authentication. id:...
Infusionsoft Gravity Forms Add-on < 1.5.7 - Cross-Site Scripting
Multiple cross-site scripting vulnerabilities in tests/notAutotestContactServicepauseCampaign.php in the Infusionsoft Gravity Forms plugin before 1.5.6 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 go, 2 contactId, or 3 campaignId parameter. id: CVE-2014-45...
CVE-2026-74004
Subscriber Broken Access Control in Gravity Booster Styles & Layouts for Gravity Forms = 6.0 versions...
CVE-2026-32466
Subscriber SQL Injection in Gravity Forms Bookings premium = 2.1 versions...
EUVD-2026-60813
Subscriber Broken Access Control in Gravity Booster Styles & Layouts for Gravity Forms = 6.0 versions...
CVE-2026-74004 WordPress Gravity Booster – Styles & Layouts for Gravity Forms plugin <= 6.0 - Broken Access Control vulnerability
Subscriber Broken Access Control in Gravity Booster Styles & Layouts for Gravity Forms = 6.0 versions...
CVE-2026-74004
The WordPress plugin "Gravity Booster – Styles & Layouts for Gravity Forms" (versions ≤ 6.0) has a broken access control flaw exploitable by authenticated subscribers, allowing unauthorized access to plugin functions. CVSS 3.1 score is 5.4 (MEDIUM) with network attack vector, low privileges requi...
CVE-2026-32466 WordPress Gravity Forms Bookings premium plugin <= 2.1 - SQL Injection vulnerability
Subscriber SQL Injection in Gravity Forms Bookings premium = 2.1 versions...
EUVD-2026-60902
Subscriber SQL Injection in Gravity Forms Bookings premium = 2.1 versions...
CVE-2026-32466
Subscriber SQL Injection in Gravity Forms Bookings premium = 2.1 versions...
CVE-2026-32466 WordPress Gravity Forms Bookings premium plugin <= 2.1 - SQL Injection vulnerability
Subscriber SQL Injection in Gravity Forms Bookings premium = 2.1 versions...
CVE-2026-32466
The Gravity Forms Bookings premium WordPress plugin (versions ≤ 2.1) contains a SQL injection flaw exploitable by authenticated subscribers. CVSS 8.5 (HIGH) reflects network access with low privileges. Patchstack reports it; no in-the-wild exploitation or patch version details are provided in the...
WordPress Gravity Booster – Styles & Layouts for Gravity Forms plugin <= 6.1 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Gravity Booster Styles & Layouts for Gravity Forms versions = 6.1...
CVE-2026-12477
The Gravity Booster – Styles & Layouts for Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 5.26 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...
EUVD-2026-59856
The Gravity Booster – Styles & Layouts for Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 5.26 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...
CVE-2026-12477 Gravity Booster <= 5.26 - Authenticated (Editor+) Stored Cross-Site Scripting via 'stylerSettings' Parameter
The Gravity Booster – Styles & Layouts for Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 5.26 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...
CVE-2026-12477
The Gravity Booster – Styles & Layouts for Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 5.26 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...
CVE-2026-12477
The CVE-2026-12477 entry concerns the Gravity Booster – Styles & Layouts for Gravity Forms plugin for WordPress. A Stored Cross‑Site Scripting (XSS) flaw exists in admin settings across all versions up to and including 5.26, caused by insufficient input sanitization and output escaping. The vulne...