{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/gravity-forms--3.1.2/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:gravity_forms:gravity_forms:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.2,"id":"CVE-2026-97645"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Gravity Forms (\u003c= 3.1.2)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Gravity Forms"],"content_html":"\u003cp\u003eThe Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the List Field in all versions up to, and including, 3.1.2. This vulnerability stems from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary web scripts. The injected scripts execute when an administrator accesses an injected page, clicks the injected link in the entry detail view, and confirms a dialog. This action triggers the admin JavaScript bundle's delegated data-dialog-callback handler to invoke the attacker-supplied function reference.\u003c/p\u003e\n","date_modified":"2026-10-30T09:27:24Z","date_published":"2026-10-30T09:27:24Z","id":"https://feed.craftedsignal.io/briefs/2026-10-gravity-forms-xss-d96f0cfe/","summary":"The Gravity Forms plugin for WordPress (all versions up to, and including, 3.1.2) is vulnerable to Stored Cross-Site Scripting (XSS) via the List Field due to insufficient input sanitization and output escaping.","title":"Gravity Forms: Stored Cross-Site Scripting (CVE-2026-97645)","url":"https://feed.craftedsignal.io/briefs/2026-10-gravity-forms-xss-d96f0cfe/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:rocketgenius:gravity_forms:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-103039"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Gravity Forms (\u003c= 3.1.2)"],"_cs_severities":["critical"],"_cs_tags":["wordpress","deserialization","rce"],"_cs_type":"advisory","_cs_vendors":["Rocketgenius"],"content_html":"\u003cp\u003eGravity Forms versions 3.1.2 and earlier contain a PHP object injection vulnerability within the List input type of Post Custom Fields. The plugin incorrectly uses the native WordPress global \u003ccode\u003emaybe_unserialize()\u003c/code\u003e function instead of the secure \u003ccode\u003eGFCommon::maybe_unserialize()\u003c/code\u003e method. This allows unauthenticated attackers to supply serialized PHP objects. While the plugin contains no native gadget chains, exploitation is possible if other installed plugins, themes, or the WordPress core itself contain compatible gadgets. Notably, targeting the \u003ccode\u003e_wp_page_template\u003c/code\u003e meta key allows for RCE on environments where \u003ccode\u003eregister_argc_argv\u003c/code\u003e is enabled and a PEAR installation is accessible.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated attackers to perform remote code execution if a suitable gadget chain exists in the WordPress environment.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the Gravity Forms plugin to the latest version (patch released by Rocketgenius).\u003c/li\u003e\n\u003cli\u003eAudit the WordPress site for plugins or themes that may contain dangerous deserialization gadget chains.\u003c/li\u003e\n\u003cli\u003eDisable the \u003ccode\u003eregister_argc_argv\u003c/code\u003e PHP configuration if not strictly required to mitigate the core-based gadget chain.\u003c/li\u003e\n\u003cli\u003eReview custom field configurations to identify if they are mapped to sensitive meta keys like \u003ccode\u003e_wp_page_template\u003c/code\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-30T09:26:40Z","date_published":"2026-10-30T09:26:40Z","id":"https://feed.craftedsignal.io/briefs/2026-10-gravity-forms-injection/","summary":"Gravity Forms for WordPress versions up to and including 3.1.2 is vulnerable to unauthenticated PHP object injection via Post Custom Fields, which can lead to remote code execution when combined with specific gadget chains.","title":"Gravity Forms: PHP object injection in Post Custom Fields (CVE-2026-103039)","url":"https://feed.craftedsignal.io/briefs/2026-10-gravity-forms-injection/"}],"language":"en","title":"CraftedSignal Threat Feed - Gravity Forms (\u003c= 3.1.2)","version":"https://jsonfeed.org/version/1.1"}