CVE-2026-5112: WordPress Gravity Forms XSS Vulnerability

CVE-2026-5112 Overview

CVE-2026-5112 is an unauthenticated Stored Cross-Site Scripting (XSS) vulnerability in the Gravity Forms plugin for WordPress, affecting versions up to and including 2.10.0. The flaw resides in the handling of Calculation Product field product names when rendered inside Repeater fields. Insufficient input validation and output escaping allow attackers to inject arbitrary JavaScript through public form submissions. The injected payload executes when an authenticated administrator with the gravityforms_view_entries capability views the entry detail page in wp-admin. The weakness is classified under CWE-79.

Critical Impact

Unauthenticated attackers can submit forms containing malicious HTML that executes in administrator browsers, enabling session theft, account takeover, and arbitrary actions in the WordPress admin context.

Affected Products

• Gravity Forms plugin for WordPress, versions ≤ 2.10.0
• WordPress sites using Calculation Product fields inside Repeater fields
• Administrative users with the gravityforms_view_entries capability

Discovery Timeline

• 2026-05-02 - CVE-2026-5112 published to NVD
• 2026-05-05 - Last updated in NVD database

Technical Details for CVE-2026-5112

Vulnerability Analysis

The vulnerability stems from inconsistent validation and sanitization across the field-handling pipeline in Gravity Forms. The validate() method in the GF_Field_Calculation class only validates the quantity sub-field (input suffix .3) and ignores the product name sub-field (input suffix .1). Malicious HTML submitted in the product name passes validation unmodified.

During entry persistence, the sanitize_entry_value() method returns the raw value without sanitization for fields where HTML is not expected. The data is stored verbatim in the database. When an administrator opens the entry detail view, get_value_entry_detail() concatenates the unescaped product name directly into the output string. The Repeater field's own get_value_entry_detail() then renders that string without further escaping, completing the script execution chain.

Because exploitation requires only an unauthenticated form submission and victim-side rendering occurs in a privileged context, attackers can chain this primitive to perform administrative actions, exfiltrate nonces, or pivot to plugin/theme modification.

Root Cause

The root cause is a missing sanitization branch for the .1 (product name) sub-field of Calculation Product inputs combined with double-trust output rendering inside Repeater containers. The code assumes the parent field type implies safe content, so neither the storage layer nor the rendering layer applies HTML escaping such as esc_html() or wp_kses().

Attack Vector

An attacker locates a public WordPress form using a Calculation Product field nested in a Repeater. They submit the form with a crafted product name containing HTML or JavaScript such as event-handler attributes on permitted tags or <script> blocks. No authentication, user interaction beyond a normal submission, or special privileges are required. The payload triggers when any administrator with gravityforms_view_entries opens the corresponding entry in wp-admin.

No verified public exploit code is available at the time of writing. Refer to the Wordfence Vulnerability Analysis for additional technical detail.

Detection Methods for CVE-2026-5112

Indicators of Compromise

• Gravity Forms entries containing HTML tags, <script> elements, or on*= event handlers in Calculation Product name fields.
• Outbound requests from administrator browsers to unfamiliar domains immediately after viewing form entries in wp-admin.
• Unexpected creation of WordPress administrator accounts or modification of plugin/theme files following entry review.
• Web server access logs showing form submissions with encoded HTML in input_*_1 parameters tied to Calculation Product fields.

Detection Strategies

• Query the wp_gf_entry_meta table for entry values containing characters such as <, >, script, or onerror within Calculation Product name fields.
• Deploy Web Application Firewall (WAF) rules that inspect Gravity Forms POST submissions for HTML in product-name parameters.
• Monitor administrator session activity and DOM events on Gravity Forms entry detail pages for unexpected script execution.

Monitoring Recommendations

• Enable WordPress audit logging for entry views, user role changes, and plugin/theme file modifications.
• Forward web server and WordPress logs to a centralized analytics platform and alert on anomalous administrator-initiated requests.
• Track Gravity Forms plugin version across all WordPress installations and flag any host running 2.10.0 or earlier.

How to Mitigate CVE-2026-5112

Immediate Actions Required

• Update the Gravity Forms plugin to the patched version listed in the Gravity Forms Change Log immediately.
• Audit existing form entries for HTML or script content in Calculation Product name fields and purge malicious entries before any administrator views them.
• Rotate administrator credentials and invalidate active sessions if suspicious entries are found.

Patch Information

Gravity Forms has issued a corrected release that adds proper input validation in GF_Field_Calculation::validate() and applies output escaping in get_value_entry_detail() for product name sub-fields rendered inside Repeater containers. Consult the Gravity Forms Change Log for the exact fixed version and upgrade instructions.

Workarounds

• Temporarily disable forms that contain Calculation Product fields nested inside Repeater fields until the patch is applied.
• Restrict the gravityforms_view_entries capability to a minimal set of trusted administrators to reduce victim surface.
• Deploy a WAF rule to strip or block HTML metacharacters in Gravity Forms submission parameters corresponding to product name inputs.

# Example WAF rule pattern (ModSecurity-style) to block HTML in Gravity Forms product name fields
SecRule ARGS_NAMES "@rx ^input_[0-9]+_1$" \
  "chain,phase:2,deny,status:403,id:1026512,msg:'CVE-2026-5112 Gravity Forms XSS attempt'"
  SecRule ARGS "@rx (<[a-z!/?]|on[a-z]+\s*=|javascript:)" "t:lowercase,t:urlDecodeUni"