CVE-2026-5109
Published: 02 May 2026
Summary
CVE-2026-5109 is a high-severity Cross-site Scripting (CWE-79) vulnerability in Gravityforms (inferred from references). Its CVSS base score is 7.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 6.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2026-5109 is a Stored Cross-Site Scripting (XSS) vulnerability in the Gravity Forms plugin for WordPress, affecting versions up to and including 2.10.0. The flaw arises from insufficient validation and output escaping of Product Option field values. The state validation function accepts submitted values if their wp_kses()-sanitized version matches a legitimate option value, but it stores the raw, unsanitized value in the database. Subsequently, when administrators view entry details via the Order Summary section, the option_label is output directly without escaping in view-order-summary.php at line 32, allowing injected JavaScript to execute.
Unauthenticated attackers can exploit this vulnerability by submitting malicious payloads in Product Option fields during form submissions, injecting arbitrary web scripts into entry data. The scripts execute in the context of an administrator's browser whenever they access the affected entry details page. This can lead to consequences such as session hijacking, credential theft, or further site compromise, as indicated by the CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), highlighting network accessibility, low attack complexity, no privileges required, no user interaction, and changed scope.
Advisories and patch information are detailed in the Gravity Forms change log at https://docs.gravityforms.com/gravityforms-change-log/ and Wordfence threat intelligence at https://www.wordfence.com/threat-intel/vulnerabilities/id/651fa700-2462-4c9c-bd13-85f3a53a64df?source=cve, which security practitioners should consult for mitigation steps, including updating to a version beyond 2.10.0.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-26741
Vulnerability details
The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 2.10.0. This is due to insufficient validation and output escaping of Product Option field values. The vulnerability exists because the state validation…
more
function accepts submitted values where the wp_kses()-sanitized version matches a legitimate option value, but then stores the raw unsanitized value in the database. When administrators view entry details via the Order Summary section, the option_label is output directly without escaping (view-order-summary.php line 32), executing the injected JavaScript. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in entry data that will execute whenever an administrator accesses the entry details page.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stored XSS in public-facing WordPress plugin enables direct exploitation of public-facing applications via form submission (T1190) and injection/execution of arbitrary JavaScript in admin browser context (T1059.007), facilitating session hijacking and credential theft.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the insufficient validation of Product Option field values that allows storage of raw unsanitized inputs matching sanitized legitimate options.
Directly addresses the lack of output escaping of option_label when administrators view entry details in the Order Summary section, preventing XSS execution.
Requires timely remediation of the identified flaw in Gravity Forms versions up to 2.10.0 by applying patches or updates to eliminate the stored XSS vulnerability.