Known vulnerabilities in the Gravity Forms plugin

17 security advisories have been published for the Gravity Forms plugin. Each entry below states what an attacker can do, what privilege they need, and the version the issue was fixed in.

Gravity Forms - Path Traversal (CVE-2026-12997) HIGH 2026-07-15
Gravity Forms - Cross-Site Scripting (XSS) (CVE-2026-5113) HIGH 2026-05-02
Gravity Forms - Cross-Site Scripting (XSS) (CVE-2026-5112) HIGH 2026-05-02
Gravity Forms - Cross-Site Scripting (XSS) (CVE-2026-5111) HIGH 2026-05-02
Gravity Forms - Cross-Site Scripting (XSS) (CVE-2026-5110) HIGH 2026-05-02
Gravity Forms - Cross-Site Scripting (XSS) (CVE-2026-5109) HIGH 2026-05-02
Gravity Forms - Cross-Site Scripting (XSS) (CVE-2026-4394) MEDIUM 2026-04-08
Gravity Forms - Cross-Site Scripting (XSS) (CVE-2026-4406) MEDIUM 2026-04-08
Gravity Forms - Broken Access Control (CVE-2026-3492) MEDIUM 2026-03-11
Gravity Forms - Remote Code Execution (CVE-2025-13407) MEDIUM 2025-12-24
Gravity Forms - Remote Code Execution (CVE-2025-12974) HIGH 2025-11-18
Gravity Forms - Remote Code Execution (CVE-2025-12352) CRITICAL 2025-11-07
Gravity Forms - Cross-Site Scripting (XSS) (CVE-2024-13377) HIGH 2025-01-17
Gravity Forms - Cross-Site Scripting (XSS) (CVE-2024-13378) MEDIUM 2025-01-17
Gravity Forms - Cross-Site Scripting (XSS) (CVE-2023-2701) MEDIUM 2023-07-17
Gravity Forms - Authentication Bypass (CVE-2023-2706) HIGH 2023-05-17
Gravity Forms - Cross-Site Request Forgery (CSRF) (CVE-2022-3154) HIGH 2022-10-10

Browse the full threat database

WordPress security that blocks attacks before they land.

sales@hackhalt.com

© Hack Halt Inc. All rights reserved.