CVE-2026-87796

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · CVE-2026-87796 Write-up: https://abraxaslabs.tech/research/CVE-2026-87796 CVE-2026-87796 Multi Uploader for Gravity Forms 1.1.9 - sh1zen I am @abraxasnull. Loopback lab. The client is CVE-2026-87796-Abraxas-Labs.py...

CVE-2026-4406

Gravity Forms = 2.9.28 — Unauthenticated Reflected Cross-Site Scripting via gformgetconfig formids Parameter Vulnerability Summary Field| Value ---|--- Affected Software| Gravity Forms WordPress Plugin Vendor| Rocketgenius, Inc. Vulnerability Type| CWE-79: Improper Neutralization of Input During...

Infusionsoft Gravity Forms Add-on < 1.5.7 - Cross-Site Scripting

Multiple cross-site scripting vulnerabilities in tests/notAutotestContactServicepauseCampaign.php in the Infusionsoft Gravity Forms plugin before 1.5.6 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 go, 2 contactId, or 3 campaignId parameter. id: CVE-2014-45...

WordPress Gravity Forms Plugin <=3.1.0.4 - Unauthenticated Arbitrary File Upload

Gravity Forms WordPress plugin version 3.1.0.4 and earlier contains an unauthenticated arbitrary file upload vulnerability caused by bypassing extension validation in hidden file upload fields. Unauthenticated attackers can upload any file type including PHP when a form has a File Upload field...

CVE-2024-0710

CVE-2024-0710 Vulnerability: CVE-2024-0710 Unauthenticated Form Submission Unique ID Modification CVSS: 5.3 Medium Software: GP Unique ID gp-unique-id Affected versions: = 1.5.5 Patched version: 1.5.6 Developer: Gravity Wiz Researcher: Karl Emil Nikka, Nikka Systems Publicly published: 2024-04-10...

CVE-2026-48866

┌───────────────────────────────────────────────────────────┐ │ │ │ C V E - 2 0 2 6 - 4 8 8 6 6 │ │ │ │ Gravity Forms Path Traversal → Arbitrary File D...

WordPress Gravity Forms plugin < 3.2.2 - Unauthenticated LFI vulnerability

Unauthenticated LFI vulnerability discovered by endangcamon in WordPress Plugin Gravity Forms versions 3.2.2...

CVE-2026-84434

CVE-2026-84434 — Gravity Forms Unauthenticated Arbitrary File Upload Python 3 PoC scanner and exploit for CVE-2026-84434 in Gravity Forms. | ---|--- Plugin| gravityforms Affected| ≤ 3.1.0.4 Fixed in| 3.1.0.5+ vendor security release 3.1.1 CVSS| 9.8 Critical Auth| Unauthenticated CWE| CWE-434 —...

CVE-2026-119529

The Gravity Forms WordPress plugin before 3.2.2 does not properly restrict the file types that unauthenticated users can upload through its chunked file upload feature, allowing them to read server environment variables and the contents of files within the web root on servers configured to parse...

EUVD-2026-123182

The Gravity Forms WordPress plugin before 3.2.2 does not properly restrict the file types that unauthenticated users can upload through its chunked file upload feature, allowing them to read server environment variables and the contents of files within the web root on servers configured to parse...

CVE-2026-119529 Gravity Forms < 3.2.2 - Unauthenticated LFI via Chunked File Upload

The Gravity Forms WordPress plugin before 3.2.2 does not properly restrict the file types that unauthenticated users can upload through its chunked file upload feature, allowing them to read server environment variables and the contents of files within the web root on servers configured to parse...

CVE-2026-119529

The Gravity Forms WordPress plugin, in versions before 3.2.2 , contains an unauthenticated Local File Inclusion (LFI) vulnerability. The flaw exists because the plugin fails to properly restrict file types during the chunked file upload feature. On servers configured to parse Server-Side Include ...

PT-2026-145018

Name of the Vulnerable Software and Affected Versions Gravity Forms versions prior to 3.2.2 Description An issue exists in the chunked file upload feature where the plugin fails to properly restrict the file types that unauthenticated users can upload. On servers configured to parse Server-Side...

VulnCheck KEV: CVE-2026-119529

The Gravity Forms WordPress plugin before 3.2.2 does not properly restrict the file types that unauthenticated users can upload through its chunked file upload feature, allowing them to read server environment variables and the contents of files within the web root on servers configured to parse...

CVE-2026-119529: Unknown Gravity Forms: The Gravity Forms WordPress plugin before 3.2.2 does not properly restrict the file types that unauthenticated users…

The Gravity Forms WordPress plugin before 3.2.2 does not properly restrict the file types that unauthenticated users can upload through its chunked file upload feature, allowing them to read server environment variables and the contents of files within the web root on servers configured to parse...

CVE-2026-121792

The GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI plugin for WordPress is vulnerable to generic SQL Injection via the 'input. Gravity Forms name-field part, or list-field row' parameter in all versions up to, and including, 8.1.1 due to insufficient...

CVE-2026-121792

The GamiPress – Gamification plugin for WordPress is vulnerable to a generic SQL Injection in all versions up to and including 8.1.1 . The root cause is insufficient escaping of the user-supplied input_. parameter and a lack of sufficient preparation on the existing SQL query. This vulnerability ...

EUVD-2026-118971

The GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI plugin for WordPress is vulnerable to generic SQL Injection via the 'input. Gravity Forms name-field part, or list-field row' parameter in all versions up to, and including, 8.1.1 due to insufficient...

CVE-2026-121792 GamiPress <= 8.1.1 - Authenticated (Subscriber+) SQL Injection via 'Gravity Forms Name/List Field' Parameter

The GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI plugin for WordPress is vulnerable to generic SQL Injection via the 'input. Gravity Forms name-field part, or list-field row' parameter in all versions up to, and including, 8.1.1 due to insufficient...

WordPress Gravity Forms 3.1.2 PHP Object Injection

WordPress Gravity Forms version 3.1.2 and prior contain an unauthenticated PHP object injection vulnerability in Post Custom Field List inputs with content templates enabled. The included proof of concept identifies forms and fields and submits a supplied serialized payload...