CVE-2024-13378

The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘stylesettings’ parameter in versions 2.9.0.1 up to, and including, 2.9.1.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2024-13378 GravityForms 2.9.0.1 - 2.9.1.3 - Unauthenticated Stored Cross-Site Scripting via 'style_settings' parameter

The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘stylesettings’ parameter in versions 2.9.0.1 up to, and including, 2.9.1.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2024-13378

CVE-2024-13378 (Gravity Forms, WordPress) : Stored Cross-Site Scripting via the style_settings parameter in Gravity Forms versions 2.9.0.1–2.9.1.3 due to insufficient input sanitization and output escaping. Vulnerability allows unauthenticated attackers to inject scripts that execute when a user ...

CVE-2024-13378 GravityForms 2.9.0.1 - 2.9.1.3 - Unauthenticated Stored Cross-Site Scripting via 'style_settings' parameter

The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘stylesettings’ parameter in versions 2.9.0.1 up to, and including, 2.9.1.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2024-13377

The CVE-2024-13377 entry refers to the Gravity Forms plugin for WordPress, vulnerable to a Stored Cross-Site Scripting (Stored XSS) via the alt parameter in all versions up to and including 2.9.1.3. The underlying cause is insufficient input sanitization and output escaping, enabling unauthentica...

CVE-2024-13377 GravityForms <= 2.9.1.3 - Unauthenticated Stored Cross-Site Scripting via 'alt' parameter

The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘alt’ parameter in all versions up to, and including, 2.9.1.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web script...

PT-2025-2141 · WordPress · Gravity Forms

Name of the Vulnerable Software and Affected Versions: Gravity Forms plugin for WordPress versions up to, and including, 2.9.1.3 Description: The issue is related to Stored Cross-Site Scripting via the alt parameter due to insufficient input sanitization and output escaping. This allows...

PT-2025-2142 · Google · Google Chrome

Name of the Vulnerable Software and Affected Versions: Gravity Forms plugin for WordPress versions 2.9.0.1 through 2.9.1.3 Description: The issue concerns a Stored Cross-Site Scripting vulnerability via the style settings parameter due to insufficient input sanitization and output escaping. This...

WordPress plugin Gravity Forms 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin ... A cross-site scripting...

WordPress plugin Gravity Forms 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin ... A cross-site scripting...

WordPress GravityForms plugin <= 2.9.1.3 - Unauthenticated Stored Cross-Site Scripting via 'alt' parameter vulnerability

Unauthenticated Stored Cross-Site Scripting via 'alt' parameter vulnerability discovered by mikemyers in WordPress Plugin Gravity Forms versions = 2.9.1.3...

WordPress Multi Uploader for Gravity Forms plugin <= 1.1.3 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by Colin Xu in WordPress Plugin Multi Uploader for Gravity Forms versions = 1.1.3...

CVE-2024-8718

The Gravity Forms Toolbar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all versions up to, and including, 1.7.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary w...

CVE-2024-8718 Gravity Forms Toolbar <= 1.7.0 - Reflected Cross-Site Scripting

The Gravity Forms Toolbar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all versions up to, and including, 1.7.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary w...

CVE-2024-8718

CVE-2024-8718: Gravity Forms Toolbar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the tab parameter in versions up to and including 1.7.0. The vulnerability allows unauthenticated attackers to inject scripts into pages invoked when a user is enticed to perform an actio...

CVE-2024-8718 Gravity Forms Toolbar <= 1.7.0 - Reflected Cross-Site Scripting

The Gravity Forms Toolbar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all versions up to, and including, 1.7.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary w...

WordPress Gravity Forms Toolbar plugin <= 1.7.0 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Webbernaut in WordPress Plugin Gravity Forms Toolbar versions = 1.7.0...

WordPress Gravity Forms Toolbar Plugin <= 1.7.0 is vulnerable to Cross Site Scripting (XSS)

Software Gravity Forms Toolbar Type Plugin Vulnerable versions = 1.7.0 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-8718 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 56480313412d Credits Webbernaut...

WordPress plugin Gravity Forms Toolbar 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

PT-2024-39198 · WordPress · Gravity Forms Toolbar

Name of the Vulnerable Software and Affected Versions: Gravity Forms Toolbar plugin for WordPress version 1.7.0 and earlier Description: The issue is related to Reflected Cross-Site Scripting via the tab parameter due to insufficient input sanitization and output escaping. This allows...