CVE-2026-5110: Gravity Forms WordPress Plugin XSS Flaw

CVE-2026-5110 Overview

CVE-2026-5110 is an unauthenticated stored Cross-Site Scripting (XSS) vulnerability in the Gravity Forms plugin for WordPress, affecting all versions up to and including 2.10.0. The flaw exists in the SingleProduct field when nested inside a Repeater field, where validation logic skips state checks and output escaping. Unauthenticated attackers can inject arbitrary HTML and JavaScript into the product name field. The payload executes in the administrator's browser when they view the entry in wp-admin/admin.php?page=gf_entries. This vulnerability is classified under CWE-79.

Critical Impact

Unauthenticated attackers can store JavaScript payloads that execute in WordPress administrator sessions, enabling account takeover, content modification, and pivot to broader site compromise.

Affected Products

• Gravity Forms plugin for WordPress, versions up to and including 2.10.0
• WordPress sites using SingleProduct fields nested inside Repeater fields
• WordPress administrator interfaces accessing affected form entries

Discovery Timeline

• 2026-05-02 - CVE-2026-5110 published to NVD
• 2026-05-05 - Last updated in NVD database

Technical Details for CVE-2026-5110

Vulnerability Analysis

The vulnerability stems from a validation bypass in Gravity Forms' nested field handling. When a SingleProduct field is placed inside a Repeater field, the plugin invokes validate_subfield() instead of the standard validation flow. This subfield path calls only the field's validate() method, skipping the failed_state_validation() check that detects tampered field values.

For SingleProduct fields, validate() only inspects the quantity input and ignores the product name input (input .1). Attackers can submit arbitrary HTML and JavaScript through the product name parameter without triggering validation errors. The submitted value reaches sanitize_entry_value(), which returns raw input when HTML is not expected for the field type, leaving the payload intact in the database.

When an administrator opens the affected entry, get_value_entry_detail() renders the stored product name without escaping. The browser parses the injected markup and executes the attacker's JavaScript in the administrator's authenticated session.

Root Cause

The root cause is twofold: incomplete state validation for nested subfields and missing output escaping in the entry detail renderer. The combination allows untrusted input to traverse from form submission to administrator browser without sanitization at any boundary.

Attack Vector

The attack requires no authentication and no user interaction from the attacker side. An attacker submits a crafted form containing a Repeater field with a nested SingleProduct subfield. The product name input carries the XSS payload. The payload triggers when any administrator views the entry in the Gravity Forms entries dashboard.

The vulnerability mechanism is documented in the Wordfence Vulnerability Report. No verified public proof-of-concept code is available at the time of writing.

Detection Methods for CVE-2026-5110

Indicators of Compromise

• Gravity Forms entries containing <script>, onerror=, onload=, or javascript: strings in product name fields
• Unexpected outbound requests from administrator browsers to attacker-controlled domains following entry review
• New WordPress administrator accounts created shortly after entry views
• Modifications to plugin files, theme files, or wp_options initiated from administrator sessions

Detection Strategies

• Audit the wp_gf_entry_meta and entry value tables for HTML tags or JavaScript event handlers in product name fields
• Inspect web server access logs for POST requests to Gravity Forms endpoints containing encoded <script> or HTML attribute payloads
• Review WordPress audit logs for administrator-initiated configuration changes correlated with entry detail views
• Compare installed Gravity Forms version against 2.10.0 and earlier across all WordPress instances

Monitoring Recommendations

• Enable file integrity monitoring on wp-content/plugins/gravityforms/ and the WordPress core directories
• Forward WordPress and web server logs to a centralized SIEM for correlation across submission and admin access events
• Alert on outbound HTTP requests from wp-admin browser sessions to unrecognized external hosts
• Track creation of new privileged WordPress accounts and changes to existing administrator capabilities

How to Mitigate CVE-2026-5110

Immediate Actions Required

• Update the Gravity Forms plugin to a version later than 2.10.0 as soon as a fix is published in the Gravity Forms Change Log
• Audit all existing form entries containing SingleProduct fields nested in Repeater fields for stored payloads
• Rotate WordPress administrator passwords and invalidate active sessions if suspicious entries are found
• Restrict access to wp-admin/admin.php?page=gf_entries to trusted IP ranges where feasible

Patch Information

Review the Gravity Forms Change Log for the patched release addressing CVE-2026-5110. The fix should enforce failed_state_validation() for nested subfields and apply output escaping in get_value_entry_detail() for product name rendering.

Workarounds

• Remove or disable forms that combine SingleProduct fields inside Repeater fields until a patched version is installed
• Deploy a Web Application Firewall (WAF) rule to block submissions containing HTML tags or JavaScript event handlers in Gravity Forms product name parameters
• Apply Content Security Policy (CSP) headers on the WordPress admin interface to limit inline script execution
• Use a least-privilege model for WordPress users so non-administrators cannot view affected entries

# Example WAF rule pattern (ModSecurity) blocking script tags in Gravity Forms input .1 fields
SecRule ARGS_NAMES "@rx ^input_[0-9]+_1$" \
    "chain,id:1026511,phase:2,deny,status:403,msg:'Potential CVE-2026-5110 XSS payload'"
    SecRule ARGS "@rx (?i)(<script|onerror=|onload=|javascript:)" "t:none,t:urlDecodeUni"