VulnSocial

CVE-2026-5111Disclosure

LOWCVSS 7.2 · HIGH

Signal is active with 4 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 2.10.0. This is due to insufficient input validation and output escaping on Hidden Product field values when used inside Repeater fields, where repeater subfields bypass state validation checks and the Hidden Product validate() method only validates the quantity field while ignoring the product name field that is later output without proper escaping in the get_value_entry_detail() method. This makes it possible for unauthenticated attackers to inject arbitrary web scripts through form submissions that will execute whenever an administrator views the entry details.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-79

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 4 mentions across 1 observed day

What's happening

  • Technical details provided in 4 signals
  • Disclosure: 3 classified signals
  • General: 1 classified signal
  • 4 total mentions across 1 day

Deep dive

Activity timeline4 mentions / 1d
01234Mentions · 2026-05-02: 4Technical Details · 2026-05-02: 405-02
Signal classification2 categories
Disclosure
375.0%
General
125.0%
Referenced assets5 URLs
Full discourse4 posts
  • Vulmon Vulnerability Feed@VulmonFeeds
    General

    CVE-2026-5111 Stored Cross-Site Scripting in Gravity Forms Plugin for Wo... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-5111 Don't wait vulnerability scanning results: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=2

    Post summary

    The tweet briefly references CVE-2026-5111 as a stored XSS in the Gravity Forms plugin, but provides no exploit code, active exploitation claims, or patch details.

    0000049
    4.0K followersView on X
  • Infoflowcloud@infoflowcloud
    Disclosure

    🚨*CVE* CVE-2026-5111 The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 2.10.0. This is due to insufficient input validation… https://www.cve.org/CVERecord?id=CVE-2026-5111 ----- Traducción: CVE-2026-5111 El … http://infoflow.cloud`

    Post summary

    The tweet announces a stored XSS vulnerability in Gravity Forms WP plugin, detailing affected versions and input validation issue, but provides no PoC, exploit code, or patch information.

    0000034
    75 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-5111 The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 2.10.0. This is due to insufficient input validation… https://www.cve.org/CVERecord?id=CVE-2026-5111

    Post summary

    The Gravity Forms WordPress plugin is disclosed to contain a stored XSS flaw in versions up to 2.10.0 caused by insufficient input validation, with a reference to the official CVE record.

    00000170
    57.4K followersView on X
  • Kaitan ID Security@KaitanSecurity
    Disclosure

    ⚠️ HIGH — CVE-2026-5111 The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 2.1… CVSS 7.2 Full analysis → https://sec.kaitan.id/cves/CVE-2026-5111 #WordPress #CyberSecurity #InfoSec

    Post summary

    The post announces that the Gravity Forms WordPress plugin is susceptible to stored XSS (CVSS 7.2) in versions up to 2.1, directing readers to a detailed analysis link.

    0000049
    458 followersView on X

Explore more

Back to dashboard