VulnTitan VulnTitan Security command center
Plugin Vulnerability Hub
Plugin 14 known issues Latest disclosed Mar 10, 2026

Gravity Forms Vulnerabilities

Review known vulnerability records for the WordPress plugin Gravity Forms (`gravityforms`), including severity, CVE references, affected versions, and patch status.

View on WordPress.org Back to Feed
Known Records
14
High or Critical
8
Linked CVEs
10
Last Updated
Mar 11, 2026
Coverage Snapshot

What this page helps you verify fast

This hub clusters every indexed record for Gravity Forms so operators can quickly confirm whether a disclosed issue maps to the installed slug and version range.

Patch Visibility
14 records include a published patch path.
Severity Mix
5 critical and 3 high severity findings.
Reference Workflow
Jump from the hub into the full report when you need remediation notes, CVSS vector details, or source references.
Known Vulnerabilities

Reports for Gravity Forms

Sorted by latest disclosure date so newly published issues surface first.

Plugin Medium Patched: Yes CVE-2026-3492
Gravity Forms <= 2.9.28.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Form Title

The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.9.28.1. This is due to a compound failure involving missing authorization on the `create_from_template` AJAX endpoint (allowing any authenticated user to cr...

Published
Mar 10, 2026
Patched Release
2.9.29
Affected Versions
Versions up to 2.9.28
Next Step
Update to 2.9.29 or newer if supported.
Open Full Report Open CVE Reference
Plugin Critical Patched: Yes CVE-2025-13407
Gravity Forms <= 2.9.23.0 - Unauthenticated Arbitrary File Upload

The Gravity Forms plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in all versions up to, and including, 2.9.23.0. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server whi...

Published
Dec 03, 2025
Patched Release
2.9.23.1
Affected Versions
Versions up to 2.9.23.0
Next Step
Update to 2.9.23.1 or newer if supported.
Open Full Report Open CVE Reference
Plugin High Patched: Yes CVE-2025-12974
Gravity Forms <= 2.9.21.1 - Unauthenticated Arbitrary File Upload via Legacy Chunked Upload

The Gravity Forms plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the legacy chunked upload mechanism in all versions up to, and including, 2.9.21.1. This is due to the extension blacklist not including .phar files, which can be...

Published
Nov 17, 2025
Patched Release
2.9.22
Affected Versions
Versions up to 2.9.21.1
Next Step
Update to 2.9.22 or newer if supported.
Open Full Report Open CVE Reference
Plugin Critical Patched: Yes CVE-2025-12352
Gravity Forms <= 2.9.20 - Unauthenticated Arbitrary File Upload via 'copy_post_image'

The Gravity Forms plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the copy_post_image() function in all versions up to, and including, 2.9.20. This makes it possible for unauthenticated attackers to upload arbitrary files on the...

Published
Nov 06, 2025
Patched Release
2.9.21
Affected Versions
Versions up to 2.9.20
Next Step
Update to 2.9.21 or newer if supported.
Open Full Report Open CVE Reference
Plugin High Patched: Yes CVE-2024-13377
GravityForms <= 2.9.1.3 - Unauthenticated Stored Cross-Site Scripting via 'alt' parameter

The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘alt’ parameter in all versions up to, and including, 2.9.1.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arb...

Published
Jan 16, 2025
Patched Release
2.9.2
Affected Versions
Versions up to 2.9.1.3
Next Step
Update to 2.9.2 or newer if supported.
Open Full Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2024-13378
GravityForms 2.9.0.1 - 2.9.1.3 - Unauthenticated Stored Cross-Site Scripting via 'style_settings' parameter

The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘style_settings’ parameter in versions 2.9.0.1 up to, and including, 2.9.1.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attacker...

Published
Jan 16, 2025
Patched Release
2.9.2
Affected Versions
2.9.0.1 through 2.9.1.3
Next Step
Update to 2.9.2 or newer if supported.
Open Full Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2023-2701
Gravity Forms <= 2.7.4 - Reflected Cross-Site Scripting

The Gravity Forms plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URLs in versions up to, and including, 2.7.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts...

Published
Jun 21, 2023
Patched Release
2.7.5
Affected Versions
Versions up to 2.7.4
Next Step
Update to 2.7.5 or newer if supported.
Open Full Report Open CVE Reference
Plugin Critical Patched: Yes CVE-2023-28782
Gravity Forms <= 2.7.3 - Unauthenticated PHP Object Injection

The Gravity Forms plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 2.7.3 via deserialization of untrusted input in the get_field_input function. This allows unauthenticated attackers to inject a PHP Object. No POP chain is present in th...

Published
May 29, 2023
Patched Release
2.7.4
Affected Versions
Versions up to 2.7.3
Next Step
Update to 2.7.4 or newer if supported.
Open Full Report Open CVE Reference
Plugin High Patched: Yes CVE-2020-13764
Gravityforms <= 2.4.8 - Information Exposure

common.php in the Gravity Forms plugin before 2.4.9 for WordPress can leak hashed passwords because user_pass is not considered a special case for a $current_user->get($property) call.

Published
May 08, 2019
Patched Release
2.4.9
Affected Versions
Versions up to 2.4.8
Next Step
Update to 2.4.9 or newer if supported.
Open Full Report Open CVE Reference
Plugin Medium Patched: Yes
Gravity Forms <= 2.0.6.5 - Cross-Site Scripting

WordPress Plugin Gravity Forms is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected si...

Published
Sep 07, 2016
Patched Release
2.0.7
Affected Versions
Versions up to 2.0.6.5
Next Step
Update to 2.0.7 or newer if supported.
Open Full Report
Plugin Medium Patched: Yes
Gravityforms <= 1.9.15.11 - Cross-Site Scripting

The Gravityforms plugin for WordPress is vulnerable to Reflected Cross-Site Scripting up to, and including, 1.9.15.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that exe...

Published
Mar 01, 2016
Patched Release
1.9.16
Affected Versions
Versions up to 1.9.15.11
Next Step
Update to 1.9.16 or newer if supported.
Open Full Report
Plugin Medium Patched: Yes
Gravityforms <= 1.9.6 - Cross-Site Scripting

The Gravityforms plugin for WordPress is vulnerable to Cross-Site Scripting in versions up to, and including, 1.9.6 due to insufficient input sanitization and output escaping alongside the use of add_query_arg or remove_query_arg(). This makes it possible for attackers to inject...

Published
Apr 20, 2015
Patched Release
1.9.7
Affected Versions
Versions up to 1.9.6
Next Step
Update to 1.9.7 or newer if supported.
Open Full Report