Advisories · Technology
Gravity Forms.
Every CVE that names Gravity Forms among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 9.8 CriticalCritical · CVSS 9+
Gravity Forms <= 3.1.2 - Unauthenticated PHP Object Injection via Post Custom Field
- Gravity Forms
- Insecure deserialization
- CVSS 7.2 High
Gravity Forms <= 3.1.2 - Unauthenticated Stored Cross-Site Scripting via List Field
- Gravity Forms
- Cross-site scripting (XSS)
- CVSS 7.2 High
Gravity Forms <= 3.1.1 - Unauthenticated Stored Cross-Site Scripting via Post Excerpt / Post Custom Field / Rich-Text Paragraph Field Values
- Gravity Forms
- Cross-site scripting (XSS)
- CVSS 9.8 CriticalCritical · CVSS 9+
Gravity Forms <= 3.1.0.4 - Unauthenticated Arbitrary File Upload via Hidden File Upload Field
- Gravity Forms
- Unrestricted file upload
- CVSS 7.2 High
Gravity Forms <= 2.10.5 - Unauthenticated Stored Cross-Site Scripting via Post Body Field Value
- Gravity Forms
- Cross-site scripting (XSS)
- CVSS 8.1 High
Gravity Forms <= 3.0.2 - Unauthenticated Arbitrary File Upload via State/Chunk Hash Confusion
- Gravity Forms
- Unrestricted file upload
- CVSS 7.5 High
Gravity Forms <= 2.10.4 - Unauthenticated Arbitrary File Read via 'gform_uploaded_files' Parameter
- Gravity Forms
- Path traversal
- CVSS 7.2 High
Gravity Forms <= 2.10.0 - Unauthenticated Stored Cross-Site Scripting via Single Product Field Inside Repeater
- Gravity Forms
- Cross-site scripting (XSS)
- CVSS 7.2 High
Gravity Forms <= 2.10.0 - Unauthenticated Stored Cross-Site Scripting via Hidden Product Field in Repeater
- Gravity Forms
- Cross-site scripting (XSS)
- CVSS 7.2 High
Gravity Forms <= 2.10.0 - Unauthenticated Stored Cross-Site Scripting via Product Option
- Gravity Forms
- Cross-site scripting (XSS)
- CVSS 7.2 High
Gravity Forms <= 2.10.0 - Unauthenticated Stored Cross-Site Scripting via Calculation Product Field in Repeater
- Gravity Forms
- Cross-site scripting (XSS)
- CVSS 7.2 High
Gravity Forms <= 2.10.0 - Unauthenticated Stored Cross-Site Scripting via Consent Field Hidden Input
- Gravity Forms
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Gravity Forms <= 2.9.30 - Unauthenticated Stored Cross-Site Scripting via Credit Card 'Card Type' Sub-Field
- Gravity Forms
- Cross-site scripting (XSS)
- CVSS 4.7 Medium
Gravity Forms <= 2.9.30 - Reflected Cross-Site Scripting via 'form_ids' Parameter
- Gravity Forms
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Gravity Forms <= 2.9.28.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Form Title
- Gravity Forms
- Cross-site scripting (XSS)
- CVSS 6.8 Medium
GravityForms < 2.9.23.1 - Unauthenticated Arbitrary File Upload
- Gravity Forms
- CVSS 8.1 High
Gravity Forms <= 2.9.21.1 - Unauthenticated Arbitrary File Upload via Legacy Chunked Upload
- Gravity Forms
- Unrestricted file upload
- CVSS 9.8 CriticalCritical · CVSS 9+
Gravity Forms <= 2.9.20 - Unauthenticated Arbitrary File Upload via 'copy_post_image'
- Gravity Forms
- Unrestricted file upload
- CVSS 5.4 Medium
GravityForms 2.9.0.1 - 2.9.1.3 - Unauthenticated Stored Cross-Site Scripting via 'style_settings' parameter
- Gravity Forms
- Cross-site scripting (XSS)
- CVSS 7.2 High
GravityForms <= 2.9.1.3 - Unauthenticated Stored Cross-Site Scripting via 'alt' parameter
- Gravity Forms
- Cross-site scripting (XSS)