Gravity Forms vulnerabilities

CVEs per yearBy the year they were published

1. 20255
2. 202615

Newest CVEs

• CVE-2026-103039

  Gravity Forms <= 3.1.2 - Unauthenticated PHP Object Injection via Post Custom Field

  Gravity Forms · Gravity Forms

  Critical9.8
• CVE-2026-97645

  Gravity Forms <= 3.1.2 - Unauthenticated Stored Cross-Site Scripting via List Field

  Gravity Forms · Gravity Forms

  High7.2
• CVE-2026-90437

  Gravity Forms <= 3.1.1 - Unauthenticated Stored Cross-Site Scripting via Post Excerpt / Post Custom Field / Rich-Text Paragraph Field Values

  Gravity Forms · Gravity Forms

  High7.2
• CVE-2026-84434

  Gravity Forms <= 3.1.0.4 - Unauthenticated Arbitrary File Upload via Hidden File Upload Field

  Gravity Forms · Gravity Forms

  Critical9.8
• CVE-2026-16649

  Gravity Forms <= 2.10.5 - Unauthenticated Stored Cross-Site Scripting via Post Body Field Value

  Gravity Forms · Gravity Forms

  High7.2
• CVE-2026-19513

  Gravity Forms <= 3.0.2 - Unauthenticated Arbitrary File Upload via State/Chunk Hash Confusion

  Gravity Forms · Gravity Forms

  High8.1
• CVE-2026-12997

  Gravity Forms <= 2.10.4 - Unauthenticated Arbitrary File Read via 'gform_uploaded_files' Parameter

  Gravity Forms · Gravity Forms

  High7.5
• CVE-2026-5110

  Gravity Forms <= 2.10.0 - Unauthenticated Stored Cross-Site Scripting via Single Product Field Inside Repeater

  Gravity Forms · Gravity Forms

  High7.2
• CVE-2026-5111

  Gravity Forms <= 2.10.0 - Unauthenticated Stored Cross-Site Scripting via Hidden Product Field in Repeater

  Gravity Forms · Gravity Forms

  High7.2
• CVE-2026-5109

  Gravity Forms <= 2.10.0 - Unauthenticated Stored Cross-Site Scripting via Product Option

  Gravity Forms · Gravity Forms

  High7.2