PT-2026-115523

Name of the Vulnerable Software and Affected Versions Gravity Forms versions prior to 3.1.1 Description Rocketgenius, Inc Gravity Forms is subject to a deserialization of untrusted data issue that allows Object Injection. Object Injection occurs when untrusted data is used to abuse the logic of a...

WordPress Gravity Forms plugin < 3.1.1 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by 0xd4rk5id3 in WordPress Plugin Gravity Forms versions 3.1.1...

VulnCheck KEV: CVE-2026-4394

The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Credit Card field's 'Card Type' sub-field input.4 in all versions up to, and including, 2.9.30. This is due to the getvalueentrydetail method in the GFFieldCreditCard class outputting the card type value...

VulnCheck KEV: CVE-2025-13407

The Gravity Forms WordPress plugin before 2.9.23.1 does not properly prevent users from uploading dangerous files through its chunked upload functionality, allowing attackers to upload PHP files to affected sites and achieve Remote Code Execution, granted they can discover or enumerate the upload...

VulnCheck KEV: CVE-2024-13377

The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘alt’ parameter in all versions up to, and including, 2.9.1.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web script...

CVE-2026-84253

The click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3. As a...

CVE-2026-84260

The click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS which could be used against high privilege users such as admin...

EUVD-2026-96759

The click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS which could be used against high privilege users such as admin...

CVE-2026-84260

The click5 CRM add-on to the Gravity Forms WordPress plugin (versions through 1.0.3 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is a failure to sanitize and escape content submitted through an unauthenticated endpoint before it is rendered on an admin page . This vulnera...

CVE-2026-84260 click5 CRM add-on to Gravity Forms <= 1.0.3 - Unauthenticated Stored XSS via post_notifications

The click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS which could be used against high privilege users such as admin...

EUVD-2026-96755

The click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3. As a...

CVE-2026-84253 click5 CRM add-on to Gravity Forms <= 1.0.3 - Unauthenticated Arbitrary Options Update

The click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3. As a...

CVE-2026-84253

The click5 CRM add-on to Gravity Forms WordPress plugin, version 1.0.3 and below , is vulnerable to unauthenticated arbitrary options updates. The root cause is a lack of authorization and CSRF checks when updating options via a REST endpoint , combined with a failure to verify that the option be...

CVE-2026-84260: Improper Neutralization of Input During Web Page Generation

The click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS which could be used against high privilege users such as admin...

PT-2026-110029

Name of the Vulnerable Software and Affected Versions click5 CRM add-on to Gravity Forms versions prior to 1.0.4 Description The plugin lacks authorization and Cross-Site Request Forgery CSRF checks when updating options through a REST endpoint. Additionally, it fails to verify if the option bein...

PT-2026-110033

Name of the Vulnerable Software and Affected Versions click5 CRM add-on to Gravity Forms WordPress plugin versions prior to 1.0.4 Description An unauthenticated endpoint fails to sanitize and escape submitted content before it is displayed on an administrative page. This leads to Stored Cross-Sit...

CVE-2026-84253: Missing Authorization

The click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3. As a...

CVE-2026-94120

Unauthenticated Broken Access Control in GravityExport Lite for Gravity Forms = 2.7.2 versions...

CVE-2026-94120 WordPress GravityExport Lite for Gravity Forms plugin <= 2.7.2 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in GravityExport Lite for Gravity Forms = 2.7.2 versions...

CVE-2026-94120 WordPress GravityExport Lite for Gravity Forms plugin <= 2.7.2 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in GravityExport Lite for Gravity Forms = 2.7.2 versions...