CVE-2026-4406

The Gravity Forms plugin for WordPress (versions up to and including 2.9.30 ) is vulnerable to Reflected Cross-Site Scripting (XSS) via the form_ids parameter in the gform_get_config AJAX action. The root cause is the GFCommon::send_json() method, which outputs JSON-encoded data using echo and wp...