CVE-2024-13378: Gravity Forms XSS Vulnerability

CVE-2024-13378 Overview

CVE-2024-13378 is a Stored Cross-Site Scripting (XSS) vulnerability in the Gravity Forms plugin for WordPress. The flaw affects versions 2.9.0.1 through 2.9.1.3 and stems from insufficient input sanitization and output escaping on the style_settings parameter. Unauthenticated attackers can inject arbitrary JavaScript that executes when a user views an affected page. Exploitation is constrained to the Chrome web browser and requires the victim to directly browse the media file through the attachment post. The weakness is tracked as [CWE-79].

Critical Impact
Unauthenticated attackers can persist malicious JavaScript in WordPress sites running vulnerable Gravity Forms versions, enabling session theft, credential harvesting, and administrative account takeover through browser-side script execution.

Affected Products

Gravity Forms plugin for WordPress version 2.9.0.1
Gravity Forms plugin for WordPress versions 2.9.1.0 through 2.9.1.3
WordPress sites running the affected plugin range with the Chrome web browser used by content viewers

Discovery Timeline

2025-01-17 - CVE-2024-13378 published to the National Vulnerability Database
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2024-13378

Vulnerability Analysis

The vulnerability is a stored XSS flaw ([CWE-79]) in the Gravity Forms style_settings parameter. The plugin accepts attacker-controlled input without adequate sanitization and later renders that input without proper output escaping. As a result, injected script content persists in the WordPress database and executes in the browser of any user who loads a page containing the malicious payload.

Exploitation does not require authentication, which broadens the attack surface to any anonymous visitor capable of reaching the vulnerable endpoint. The advisory notes that successful script execution only occurs in the Chrome web browser and requires the victim to directly browse the media file via the attachment post. This narrows the practical exploitation path but does not eliminate it, particularly on high-traffic public WordPress sites where Chrome dominates the browser mix.

Once the payload executes in an authenticated administrator's browser, attackers can perform any action the victim is authorized to perform, including creating new administrator accounts, modifying plugin settings, or exfiltrating session cookies to attacker-controlled infrastructure.

Root Cause

The root cause is missing input sanitization on the style_settings parameter combined with the absence of contextual output escaping when the value is rendered in HTML. WordPress provides helper functions such as sanitize_text_field(), wp_kses(), and esc_attr() for these tasks, but the vulnerable code paths in Gravity Forms 2.9.0.1 through 2.9.1.3 do not apply them consistently to style_settings.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction beyond a victim loading the injected content in Chrome via the attachment post view. An unauthenticated attacker submits a crafted style_settings value containing JavaScript. The payload is stored server-side and later rendered in the browser context of any user visiting the affected page.

Refer to the Wordfence Vulnerability Report for additional technical context on the injection endpoint and preconditions.

Detection Methods for CVE-2024-13378

Indicators of Compromise

WordPress database entries for Gravity Forms containing <script> tags, javascript: URIs, or event handlers such as onerror= and onload= within the style_settings field.
Unexpected outbound HTTP requests from browsers viewing WordPress attachment posts, particularly to domains not associated with the site.
New WordPress administrator accounts or unauthorized plugin installations following visits to attachment post URLs.

Detection Strategies

Query the WordPress wp_options and Gravity Forms metadata tables for HTML or script content in style_settings values.
Review web server access logs for POST requests to Gravity Forms endpoints containing encoded script payloads or unusual style_settings parameter lengths.
Deploy a Web Application Firewall (WAF) rule that inspects requests targeting Gravity Forms endpoints for XSS payload signatures.

Monitoring Recommendations

Monitor for creation of unexpected privileged WordPress accounts and audit wp_users and wp_usermeta tables for anomalies.
Enable and forward WordPress and web server logs to a centralized logging platform for retention and correlation.
Track browser-side telemetry such as Content Security Policy (CSP) violation reports to identify script execution attempts.

How to Mitigate CVE-2024-13378

Immediate Actions Required

Upgrade the Gravity Forms plugin to a version later than 2.9.1.3 as published in the Gravity Forms Change Log.
Audit existing form configurations and stored style_settings values for injected script content and remove any malicious payloads.
Rotate WordPress administrator credentials and invalidate active sessions if compromise is suspected.

Patch Information

Gravity Forms addressed the vulnerability in a release following version 2.9.1.3. Site administrators should consult the Gravity Forms Change Log for the exact fixed version and apply the update through the WordPress plugin manager or by uploading the patched archive.

Workarounds

Deploy a WAF rule that blocks requests containing HTML tags or JavaScript event handlers in the style_settings parameter until patching is complete.
Restrict access to WordPress attachment post URLs where feasible, since exploitation requires direct browsing of the media file via the attachment post.
Enforce a strict Content Security Policy that disallows inline scripts to reduce the impact of stored XSS payloads.

bash

# Example WAF rule (ModSecurity) blocking script content in style_settings
SecRule ARGS:style_settings "@rx (?i)(<script|javascript:|onerror=|onload=)" \
    "id:1013378,phase:2,deny,status:403,log,msg:'CVE-2024-13378 Gravity Forms style_settings XSS attempt'"