+ 25 vulnerabilidades conocidas más
| CVE |
Vulnerabilidad |
Tipo |
Gravedad |
Afectadas |
Corregido en |
Publicado |
Estado |
|
CVE-2025-12974
|
Gravity Forms [gravityforms] < 2.9.22 |
Carga de archivos sin restricción de tipo peligroso |
Alta
8,1
|
< 2.9.22
|
2.9.22 |
2025-11-17 |
—
|
|
CVE-2025-12352
|
Gravity Forms [gravityforms] < 2.9.21 |
Carga de archivos sin restricción de tipo peligroso |
Crítica
9,8
|
< 2.9.21
|
2.9.21 |
2025-11-06 |
—
|
|
CVE-2024-13377
|
Gravity Forms [gravityforms] < 2.9.2 |
Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) |
Alta
7,2
|
< 2.9.2
|
2.9.2 |
2025-01-16 |
—
|
|
CVE-2024-13378
|
Gravity Forms [gravityforms] < 2.9.2 |
Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) |
Media
5,4
|
< 2.9.2
|
2.9.2 |
2025-01-16 |
—
|
|
—
|
Gravity Forms [gravityforms] < 2.0.7 |
— |
Desconocido
|
< 2.0.7
|
2.0.7 |
2023-10-13 |
—
|
|
CVE-2023-2701
|
Gravity Forms [gravityforms] < 2.7.5 |
Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) |
Media
6,1
|
< 2.7.5
|
2.7.5 |
2023-06-21 |
—
|
|
—
|
Gravity Forms [gravityforms] < 1.8.20 |
— |
Desconocido
|
< 1.8.20
|
1.8.20 |
2023-06-17 |
—
|
|
CVE-2023-28782
|
Gravity Forms [gravityforms] < 2.7.4 |
Deserialización de datos no confiables |
Alta
8,3
|
< 2.7.4
|
2.7.4 |
2023-05-29 |
—
|
|
—
|
Gravity Forms [gravityforms] < 1.9.7 |
— |
Desconocido
|
< 1.9.7
|
1.9.7 |
2023-04-20 |
—
|
|
—
|
Gravity Forms [gravityforms] < 1.9.3.6 |
— |
Desconocido
|
< 1.9.3.6
|
1.9.3.6 |
2023-03-17 |
—
|
|
—
|
Gravity Forms [gravityforms] < 1.9.16 |
— |
Desconocido
|
< 1.9.16
|
1.9.16 |
2023-03-01 |
—
|
|
CVE-2020-13764
|
Gravity Forms [gravityforms] < 2.4.9 |
Exposición de información sensible a un actor no autorizado |
Alta
7,5
|
< 2.4.9
|
2.4.9 |
2019-05-08 |
—
|
|
—
|
Gravity Forms [gravityforms] < 2.0.7 |
— |
Desconocido
|
< 2.0.7
|
2.0.7 |
2016-09-07 |
—
|
|
—
|
Gravity Forms [gravityforms] < 1.9.16 |
— |
Desconocido
|
< 1.9.16
|
1.9.16 |
2016-03-01 |
—
|
|
—
|
Gravity Forms [gravityforms] < 1.9.7 |
— |
Desconocido
|
< 1.9.7
|
1.9.7 |
2015-04-20 |
—
|
|
—
|
Gravity Forms [gravityforms] < 1.8.20 |
— |
Desconocido
|
< 1.8.20
|
1.8.20 |
2015-02-26 |
—
|
|
CVE-2015-2260
|
Gravity Forms [gravityforms] >= 1.8 - <= 1.9.3.5 |
— |
Desconocido
|
1.8–1.9.3.5
|
1.9.3.5 |
0000-00-00 |
—
|
|
CVE-2026-4394
|
Gravity Forms [gravityforms] < 2.9.31 |
— |
Media
6,1
|
< 2.9.31
|
2.9.31 |
0000-00-00 |
—
|
|
CVE-2026-4406
|
Gravity Forms [gravityforms] < 2.9.31 |
— |
Media
4,7
|
< 2.9.31
|
2.9.31 |
0000-00-00 |
—
|
|
CVE-2026-3492
|
Gravity Forms [gravityforms] < 2.9.29 |
— |
Desconocido
|
< 2.9.29
|
2.9.29 |
0000-00-00 |
—
|
|
—
|
Gravity Forms [gravityforms] < 2.0.7 |
— |
Desconocido
|
< 2.0.7
|
2.0.7 |
— |
—
|
|
—
|
Gravity Forms [gravityforms] < 1.9.16 |
— |
Desconocido
|
< 1.9.16
|
1.9.16 |
— |
—
|
|
—
|
Gravity Forms [gravityforms] < 1.9.7 |
— |
Desconocido
|
< 1.9.7
|
1.9.7 |
— |
—
|
|
—
|
Gravity Forms [gravityforms] < 1.9.3.6 |
— |
Desconocido
|
< 1.9.3.6
|
1.9.3.6 |
— |
—
|
|
—
|
Gravity Forms [gravityforms] < 1.8.20 |
— |
Desconocido
|
< 1.8.20
|
1.8.20 |
— |
—
|
CVE-2025-12974
The Gravity Forms plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the legacy chunked upload mechanism in all versions up to, and including, 2.9.21.1. This is due to the extension blacklist not including .phar files, which can be uploaded through the chunked upload mechanism. This makes it possible for unauthenticated attackers to upload executable .phar files and achieve remote code execution on the server, granted they can discover or enumerate the upload path. In order for an attacker to achieve RCE, the web server needs to be set up to process .phar file as PHP via file handler mapping or similar.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
CVE.org
CVE-2025-12352
The Gravity Forms plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the copy_post_image() function in all versions up to, and including, 2.9.20. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. This only impacts sites that have allow_url_fopen set to `On`, the post creation form enabled along with a file upload field for the post
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
CVE.org
CVE-2024-13377
The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘alt’ parameter in all versions up to, and including, 2.9.1.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
CVE.org
CVE-2024-13378
The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘style_settings’ parameter in versions 2.9.0.1 up to, and including, 2.9.1.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The attack is only successful in the Chrome web browser, and requires directly browsing the media file via the attachment post.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
CVE.org
Gravity Forms [gravityforms] < 2.0.7
Update the plugin.
An unknown person discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Gravity Forms Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 2.0.7.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Patchstack
CVE-2023-2701
Update the WordPress Gravity Forms plugin to the latest available version (at least 2.7.5).
Fioravante Souza (WPScan) discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Gravity Forms Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 2.7.5.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Patchstack
Gravity Forms [gravityforms] < 1.8.20
Upgrade the plugin.
Abk Khan discovered and reported this Local File Inclusion vulnerability in WordPress Gravity Forms Plugin. This could allow a malicious actor to include local files of the target website and show its output onto the screen. Files which store credentials, such as database credentials, could potentially allow complete database takeover depending on the configuration. This vulnerability has been fixed in version 1.8.20.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Patchstack
CVE-2023-28782
The Gravity Forms plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 2.7.3 via deserialization of untrusted input in the get_field_input function. This allows unauthenticated attackers to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
Gravity Forms [gravityforms] < 1.9.7
Update the plugin to the latest version.
An unknown person discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Gravity Forms Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 1.9.7.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Patchstack
Gravity Forms [gravityforms] < 1.9.3.6
Update the plugin.
An unknown person discovered and reported this SQL Injection vulnerability in WordPress Gravity Forms Plugin. This could allow a malicious actor to directly interact with your database, including but not limited to stealing information. This vulnerability has been fixed in version 1.9.3.6.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Patchstack
Gravity Forms [gravityforms] < 1.9.16
Update the plugin.
Henri Salo discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Gravity Forms Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 1.9.16.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Patchstack
CVE-2020-13764
common.php in the Gravity Forms plugin before 2.4.9 for WordPress can leak hashed passwords because user_pass is not considered a special case for a $current_user->get($property) call.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
CVE.org
Gravity Forms [gravityforms] < 2.0.7
WordPress Plugin Gravity Forms is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. WordPress Plugin Gravity Forms version 2.0.6.5 is vulnerable; prior versions may also be affected.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
Gravity Forms [gravityforms] < 1.9.16
The Gravityforms plugin for WordPress is vulnerable to Reflected Cross-Site Scripting up to, and including, 1.9.15.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
Gravity Forms [gravityforms] < 1.9.7
The Gravityforms plugin for WordPress is vulnerable to Cross-Site Scripting in versions up to, and including, 1.9.6 due to insufficient input sanitization and output escaping alongside the use of add_query_arg or remove_query_arg(). This makes it possible for attackers to inject arbitrary web scripts that execute in a victim's browser.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
Gravity Forms [gravityforms] < 1.8.20
The Gravityforms plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation via the includes/upload.php file in versions up to, and including, 1.8.19. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
CVE-2015-2260
The Gravifyforms plugin for WordPress is vulnerable to blind SQL Injection via the ‘sort_column GET’ parameter in versions up to, and including,1.9.3.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
CVE-2026-4394
The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Credit Card field's 'Card Type' sub-field (`input_<id>.4`) in all versions up to, and including, 2.9.30. This is due to the `get_value_entry_detail()` method in the `GF_Field_CreditCard` class outputting the card type value without escaping, combined with `get_value_save_entry()` accepting and storing unsanitized user input for the `input_<id>.4` parameter. The Card Type field is not rendered on the frontend form (it is normally derived from the card number), but the backend submission parser blindly accepts it if included in the POST request. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute when an administrator views the form entry in the WordPress dashboard.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
CVE-2026-4406
The Gravity Forms plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `form_ids` parameter in the `gform_get_config` AJAX action in all versions up to, and including, 2.9.30. This is due to the `GFCommon::send_json()` method outputting JSON-encoded data wrapped in HTML comment delimiters using `echo` and `wp_die()`, which serves the response with a `Content-Type: text/html` header instead of `application/json`. The `wp_json_encode()` function does not HTML-encode angle brackets within JSON string values, allowing injected HTML/script tags in `form_ids` array values to be parsed and executed by the browser. The required `config_nonce` is generated with `wp_create_nonce('gform_config_ajax')` and is publicly embedded on every page that renders a Gravity Forms form, making it identical for all unauthenticated visitors within the same 12-hour nonce tick. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This vulnerability cannot be exploited against users who are authenticated on the target system, but could be used to alter the target page.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
CVE-2026-3492
The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.9.28.1. This is due to a compound failure involving missing authorization on the `create_from_template` AJAX endpoint (allowing any authenticated user to create forms), insufficient input sanitization (`sanitize_text_field()` preserves single quotes), and missing output escaping when the form title is rendered in the Form Switcher dropdown (`title` attribute constructed without `esc_attr()`, and JavaScript `saferHtml` utility only escapes `&`, `<`, `>` but not quotes). This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary JavaScript that executes when an Administrator searches in the Form Switcher dropdown in the Form Editor.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
Gravity Forms [gravityforms] < 2.0.7
A blind XSS vulnerability exists in the GravityForms plugin prior to version 2.0.7, in the select option dropdown boxes on forms. If the select column is displayed on the gf_entries page when viewed in the Dashboard, the code is executed by the admin / viewer of the submissions.
This vulnerability was responsibly disclosed to the vendor, with documentation, images, and proof of concept. Version 2.0.7 was delivered to the researcher to confirm the vulnerability had been patched, and an adequate timeframe was agreed upon with the vendor before public disclosure, to allow customers time to update their installations.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
WPScan
Gravity Forms [gravityforms] < 1.9.16
The gravityforms WordPress plugin was affected by a Authenticated Reflected Cross-Site Scripting (XSS) security vulnerability.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
WPScan
Gravity Forms [gravityforms] < 1.9.7
The gravityforms WordPress plugin was affected by a Cross-Site Scripting (XSS) security vulnerability.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
WPScan
Gravity Forms [gravityforms] < 1.9.3.6
Title: Gravity Forms 1.8 <= 1.9.3.5 - Blind SQL Injection CVE-2015-2260
Version/s Tested: 1.9.3.1
Description:
Gravity Forms is one of the most popular WordPress plugins (gravityforms) used to create forms for WordPress sites. The latest version at the time of writing (1.9.3.5) contains an authenticated (admin, or user with gravityforms_edit_forms capability) Blind SQL Injection vulnerability. The plugin is one of the most popular plugins for the WordPress platform.
Technical Description:
The authenticated Blind SQL Injection vulnerability can be found within the 'form_list.php' and ‘forms_model’ files. The sort_column GET parameter is not sufficiently sanitised before being used within an SQL query.
form_list.php line 106:
$sort_column = empty( $_GET['sort'] ) ? 'title' : $_GET['sort'];
form_list.php line 111:
$forms = RGFormsModel::get_forms( $active, $sort_column, $sort_direction, $trash );
forms_model.php line 106:
$sort_column = ESC_SQL( $sort_column );
$order_by = ! empty( $sort_column ) ? "ORDER BY $sort_column $sort_keyword" : '';
$sql = "SELECT f.id, f.title, f.date_created, f.is_active, 0 as lead_count, 0 view_count FROM $form_table_name f $where_clause $order_by";
According to WordPress this function 'Prepares a string for use as an SQL query. A glorified addslashes() that works with arrays.'. However, this is not sufficient to prevent SQL Injection as can be seen from the Proof of Concept.
Proof of Concept (PoC)
The following GET request will cause the SQL query to execute and sleep for 10 seconds if clicked on as an authenticated admin or other user with gravityforms_edit_forms capability.
http://localhost/wp-admin/admin.php?page=gf_edit_forms&sort=date_created%2c(select%20*%20from%20(select(sleep(10)))a)
Impact:
The original impact has been amended after further research by Ryan Dewhurst. Due to WordPress using X-Frame-Options and PHP/MySQL not supporting stacked queries, it is not currently possible to exploit this vulnerability by a remote attacker via CSRF. A reliable cross-domain timing attack using a GET request which does not rely on frames would be required to exploit this issue.
Fix for 1.8 branch:
After form_list.php line 106:
$sort_column = empty( $_GET['sort'] ) ? 'title' : $_GET['sort'];
Add:
if ( ! in_array( strtolower( $sort_column ), array( 'id', 'title', 'date_created', 'is_active', 'is_trash' ) ) ) {
$sort_column = 'title';
}
Timeline:
March 13th: 2030 CST: Vulnerability Discovered by Scott Kingsley Clark (10up.com) and vendor notified.
March 13th 2300 GMT-5: Review, exploit and temporary patch written by Ivan Kruchkoff (10up.com).
March 14th: Vendor releases 1.9.3.6
March 17th: Advisory released.
Credits:
Ryan Dewhurst (WPScan Team - Dewhurst Security) for PoC / writeup of WP SEO exploit: CVE-2015-2292, CVE-2015-2293
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
WPScan
Gravity Forms [gravityforms] < 1.8.20
The gravityforms WordPress plugin was affected by an Arbitrary File Upload security vulnerability.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
WPScan
Actualiza este plugin a la última versión de wordpress.org — cada CVE de arriba indica la versión exacta que lo corrigió ("Corregido en") cuando hay una registrada.
Este es el historial completo de vulnerabilidades conocidas del plugin, no un escaneo de una instalación específica — ejecuta un escaneo gratis de tu propio sitio para verificar tu versión instalada exacta.