Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-06-17
Gravity Forms - Security Vulnerability (CVE-2024-6550)
The Gravity Forms: Multiple Form Instances plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.1.1. This is due to the plugin leaving test files with display_errors on. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
PLUGIN
Gravity Forms
CVE-2024-6550
Risk Score
Threat Entry
Updated 2026-06-17
Gravity Forms - PHP Object Injection (CVE-2023-28782)
Deserialization of Untrusted Data vulnerability in Rocketgenius Inc. Gravity Forms.This issue affects Gravity Forms: from n/a through 2.7.3.
PLUGIN
Gravity Forms
CVE-2023-28782
Risk Score
Threat Entry
Updated 2026-06-17
Gravity Forms - Cross-Site Scripting (XSS) (CVE-2023-2701)
The Gravity Forms WordPress plugin before 2.7.5 does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting which could be used against high-privileged users such as admin.
PLUGIN
Gravity Forms
CVE-2023-2701
Risk Score
Threat Entry
Updated 2026-06-17
Gravity Forms - Security Vulnerability (CVE-2020-13764)
common.php in the Gravity Forms plugin before 2.4.9 for WordPress can leak hashed passwords because user_pass is not considered a special case for a $current_user->get($property) call.
PLUGIN
Gravity Forms
CVE-2020-13764
Risk Score
Threat Entry
Updated 2026-06-17
Gravity Forms - Cross-Site Scripting (XSS) (CVE-2017-18495)
The gravity-forms-sms-notifications plugin before 2.4.0 for WordPress has XSS.
PLUGIN
Gravity Forms
CVE-2017-18495
Risk Score
Threat Entry
Updated 2026-06-17
Gravity Forms - Cross-Site Scripting (XSS) (CVE-2017-17780)
The Clockwork SMS clockwork-test-message.php component has XSS via a crafted "to" parameter in a clockwork-test-message request to wp-admin/admin.php. This component code is found in the following WordPress plugins: Clockwork Free and Paid SMS Notifications 2.0.3, Two-Factor Authentication - Clockwork SMS 1.0.2, Booking Calendar - Clockwork SMS 1.0.5, Contact Form 7 - Clockwork SMS 2.3.0, Fast Secure Contact Form - Clockwork SMS 2.1.2, Formidable - Clockwork SMS 1.0.2, Gravity Forms - Clockwork SMS 2.2, and WP e-Commerce - Clockwork SMS 2.0.5.
PLUGIN
Gravity Forms
CVE-2017-17780
Risk Score