Gravity Forms (<= 3.1.2) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/gravity-forms--3.1.2/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 30 Oct 2026 09:27:24 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgGravity Forms: Stored Cross-Site Scripting (CVE-2026-97645)https://feed.craftedsignal.io/briefs/2026-10-gravity-forms-xss-d96f0cfe/Fri, 30 Oct 2026 09:27:24 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-gravity-forms-xss-d96f0cfe/The Gravity Forms plugin for WordPress (all versions up to, and including, 3.1.2) is vulnerable to Stored Cross-Site Scripting (XSS) via the List Field due to insufficient input sanitization and output escaping.<p>The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the List Field in all versions up to, and including, 3.1.2. This vulnerability stems from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary web scripts. The injected scripts execute when an administrator accesses an injected page, clicks the injected link in the entry detail view, and confirms a dialog. This action triggers the admin JavaScript bundle's delegated data-dialog-callback handler to invoke the attacker-supplied function reference.</p> highadvisoryGravity Forms: PHP object injection in Post Custom Fields (CVE-2026-103039)https://feed.craftedsignal.io/briefs/2026-10-gravity-forms-injection/Fri, 30 Oct 2026 09:26:40 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-gravity-forms-injection/Gravity Forms for WordPress versions up to and including 3.1.2 is vulnerable to unauthenticated PHP object injection via Post Custom Fields, which can lead to remote code execution when combined with specific gadget chains.Gravity Forms versions 3.1.2 and earlier contain a PHP object injection vulnerability within the List input type of Post Custom Fields. The plugin incorrectly uses the native WordPress global maybe_unserialize() function instead of the secure GFCommon::maybe_unserialize() method. This allows unauthenticated attackers to supply serialized PHP objects. While the plugin contains no native gadget chains, exploitation is possible if other installed plugins, themes, or the WordPress core itself contain compatible gadgets. Notably, targeting the _wp_page_template meta key allows for RCE on environments where register_argc_argv is enabled and a PEAR installation is accessible.

Impact

Successful exploitation allows unauthenticated attackers to perform remote code execution if a suitable gadget chain exists in the WordPress environment.

Recommendation

  • Update the Gravity Forms plugin to the latest version (patch released by Rocketgenius).
  • Audit the WordPress site for plugins or themes that may contain dangerous deserialization gadget chains.
  • Disable the register_argc_argv PHP configuration if not strictly required to mitigate the core-based gadget chain.
  • Review custom field configurations to identify if they are mapped to sensitive meta keys like _wp_page_template.
]]>criticaladvisorywordpressdeserializationrce