Known vulnerabilities in the Gravity Forms plugin
23 security advisories have been published for the Gravity Forms plugin. Each entry below states what an attacker can do, what privilege they need, and the version the issue was fixed in.
- Gravity Forms - Security Vulnerability (CVE-2026-84434) CRITICAL
- Gravity Forms - Cross-Site Scripting (XSS) (CVE-2026-16649) HIGH
- Gravity Forms - Remote Code Execution (CVE-2026-19513) HIGH
- Gravity Forms - Path Traversal (CVE-2026-12997) HIGH
- Gravity Forms - Cross-Site Scripting (XSS) (CVE-2026-5113) HIGH
- Gravity Forms - Cross-Site Scripting (XSS) (CVE-2026-5112) HIGH
- Gravity Forms - Cross-Site Scripting (XSS) (CVE-2026-5111) HIGH
- Gravity Forms - Cross-Site Scripting (XSS) (CVE-2026-5110) HIGH
- Gravity Forms - Cross-Site Scripting (XSS) (CVE-2026-5109) HIGH
- Gravity Forms - Cross-Site Scripting (XSS) (CVE-2026-4394) MEDIUM
- Gravity Forms - Cross-Site Scripting (XSS) (CVE-2026-4406) MEDIUM
- Gravity Forms - Broken Access Control (CVE-2026-3492) MEDIUM
- Gravity Forms - Remote Code Execution (CVE-2025-13407) MEDIUM
- Gravity Forms - Remote Code Execution (CVE-2025-12974) HIGH
- Gravity Forms - Remote Code Execution (CVE-2025-12352) CRITICAL
- Gravity Forms - Cross-Site Scripting (XSS) (CVE-2024-13377) HIGH
- Gravity Forms - Cross-Site Scripting (XSS) (CVE-2024-13378) MEDIUM
- Gravity Forms - Security Vulnerability (CVE-2024-6550) MEDIUM
- Gravity Forms - PHP Object Injection (CVE-2023-28782) HIGH
- Gravity Forms - Cross-Site Scripting (XSS) (CVE-2023-2701) MEDIUM
- Gravity Forms - Security Vulnerability (CVE-2020-13764) HIGH
- Gravity Forms - Cross-Site Scripting (XSS) (CVE-2017-18495) MEDIUM
- Gravity Forms - Cross-Site Scripting (XSS) (CVE-2017-17780) MEDIUM