WP Clinic
Entrar Registrarse

SEGURIDAD DE PLUGINS

¿Es seguro Gravityforms?

Vulnerabilidades conocidas, compatibilidad con PHP y alternativas más seguras para el plugin de WordPress Gravityforms — verificado contra la base de datos de seguridad local de WP Clinic.

Qué hace este plugin

  • Slug: gravityforms
  • 30000+ instalaciones activas

acfadvanced custom fieldsformgravity formssayhellogmbh

Estado de mantenimiento

Vulnerabilidades conocidas

19 CVEs conocidos registrados para Gravityforms.

CVE Vulnerabilidad Tipo Gravedad Afectadas Corregido en Publicado Estado
CVE-2026-12997 Gravity Forms [gravityforms] < 2.10.5 Limitación incorrecta de una ruta a un directorio restringido (Path Traversal) Alta 7,5 < 2.10.5 2.10.5 2026-07-15
CVE-2026-48866 Gravity Forms [gravityforms] < 2.10.1 Limitación incorrecta de una ruta a un directorio restringido (Path Traversal) Crítica 9,6 < 2.10.1 2.10.1 2026-06-01
CVE-2026-5111 Gravity Forms [gravityforms] < 2.10.1 Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) Alta 7,2 < 2.10.1 2.10.1 2026-05-01
CVE-2026-5110 Gravity Forms [gravityforms] < 2.10.1 Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) Alta 7,2 < 2.10.1 2.10.1 2026-05-01
CVE-2026-5113 Gravity Forms [gravityforms] < 2.10.1 Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) Alta 7,2 < 2.10.1 2.10.1 2026-05-01
CVE-2026-5112 Gravity Forms [gravityforms] < 2.10.1 Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) Alta 7,2 < 2.10.1 2.10.1 2026-05-01
CVE-2026-5109 Gravity Forms [gravityforms] < 2.10.1 Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) Alta 7,2 < 2.10.1 2.10.1 2026-05-01
CVE-2025-13407 Gravity Forms [gravityforms] < 2.9.23.1 Carga de archivos sin restricción de tipo peligroso Media 6,8 < 2.9.23.1 2.9.23.1 2025-12-03

CVE-2026-12997

The Gravity Forms plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.10.4 via the 'gform_uploaded_files' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Exploitation requires the targeted form to not enforce login (so publicly accessible), which allows the unauthenticated attacker to reach the process_send_resume_link endpoint and supply an arbitrary recipient email address to receive the traversal-retrieved file as a notification attachment.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2026-48866

The Gravity Forms plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in all versions up to, and including, 2.10.0.1. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2026-5111

The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 2.10.0. This is due to insufficient input validation and output escaping on Hidden Product field values when used inside Repeater fields, where repeater subfields bypass state validation checks and the Hidden Product validate() method only validates the quantity field while ignoring the product name field that is later output without proper escaping in the get_value_entry_detail() method. This makes it possible for unauthenticated attackers to inject arbitrary web scripts through form submissions that will execute whenever an administrator views the entry details.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2026-5110

The Gravity Forms plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting in versions up to and including 2.10.0. This is due to insufficient input validation and output escaping in the SingleProduct field when used inside a Repeater field. When SingleProduct fields are nested within Repeater fields, the validation flow bypasses the state validation mechanism (failed_state_validation()) that would normally prevent tampering with field values. The validate_subfield() method only calls the field's validate() method, which for SingleProduct fields only validates the quantity field and does not check the product name field for tampering. As a result, an attacker can inject arbitrary HTML and JavaScript into the product name field (input .1). This malicious input is then saved to the database without sanitization because sanitize_entry_value() returns raw values when HTML is not expected for the field type. When an administrator views the entry in wp-admin/admin.php?page=gf_entries, the get_value_entry_detail() method outputs the product name without escaping, causing the stored XSS payload to execute in the administrator's browser. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever an administrator accesses an entry containing the malicious payload.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2026-5113

The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Consent field hidden inputs in versions up to and including 2.10.0. This is due to a flawed state validation mechanism that fails open when input is sanitized by wp_kses(), combined with insufficient output escaping. The state validation logic creates two hashes (raw input and wp_kses-sanitized input) and only fails validation if BOTH hashes don't match the original state. When an attacker injects XSS payloads using tags stripped by wp_kses() (like <svg>), the sanitized hash matches while the malicious raw value is preserved and saved to the database. When administrators view the Entries List page, the stored malicious consent label is retrieved and output without escaping, causing the XSS payload to execute. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in entries that will execute whenever an authenticated administrator accesses the entries list page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2026-5112

The Gravity Forms plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting in versions up to and including 2.10.0. This is due to insufficient input validation and output escaping of Calculation Product field product names when rendered inside Repeater fields. The validate() method in the GF_Field_Calculation class only validates the quantity field (.3) and completely ignores the product name field (.1), allowing malicious HTML to pass through validation. When the value is saved, the sanitize_entry_value() method returns the raw value without sanitization for fields where HTML is not expected. Subsequently, when an entry is viewed in wp-admin, the get_value_entry_detail() method concatenates the unescaped product name directly into the output string, which is then rendered by the repeater's get_value_entry_detail() method without further escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts via form submissions that will execute whenever an authenticated administrator with the gravityforms_view_entries capability accesses the entry detail page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2026-5109

The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 2.10.0. This is due to insufficient validation and output escaping of Product Option field values. The vulnerability exists because the state validation function accepts submitted values where the wp_kses()-sanitized version matches a legitimate option value, but then stores the raw unsanitized value in the database. When administrators view entry details via the Order Summary section, the option_label is output directly without escaping (view-order-summary.php line 32), executing the injected JavaScript. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in entry data that will execute whenever an administrator accesses the entry details page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2025-13407

The Gravity Forms plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in all versions up to, and including, 2.9.23.0. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

+ 25 vulnerabilidades conocidas más
CVE Vulnerabilidad Tipo Gravedad Afectadas Corregido en Publicado Estado
CVE-2025-12974 Gravity Forms [gravityforms] < 2.9.22 Carga de archivos sin restricción de tipo peligroso Alta 8,1 < 2.9.22 2.9.22 2025-11-17
CVE-2025-12352 Gravity Forms [gravityforms] < 2.9.21 Carga de archivos sin restricción de tipo peligroso Crítica 9,8 < 2.9.21 2.9.21 2025-11-06
CVE-2024-13377 Gravity Forms [gravityforms] < 2.9.2 Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) Alta 7,2 < 2.9.2 2.9.2 2025-01-16
CVE-2024-13378 Gravity Forms [gravityforms] < 2.9.2 Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) Media 5,4 < 2.9.2 2.9.2 2025-01-16
Gravity Forms [gravityforms] < 2.0.7 Desconocido < 2.0.7 2.0.7 2023-10-13
CVE-2023-2701 Gravity Forms [gravityforms] < 2.7.5 Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) Media 6,1 < 2.7.5 2.7.5 2023-06-21
Gravity Forms [gravityforms] < 1.8.20 Desconocido < 1.8.20 1.8.20 2023-06-17
CVE-2023-28782 Gravity Forms [gravityforms] < 2.7.4 Deserialización de datos no confiables Alta 8,3 < 2.7.4 2.7.4 2023-05-29
Gravity Forms [gravityforms] < 1.9.7 Desconocido < 1.9.7 1.9.7 2023-04-20
Gravity Forms [gravityforms] < 1.9.3.6 Desconocido < 1.9.3.6 1.9.3.6 2023-03-17
Gravity Forms [gravityforms] < 1.9.16 Desconocido < 1.9.16 1.9.16 2023-03-01
CVE-2020-13764 Gravity Forms [gravityforms] < 2.4.9 Exposición de información sensible a un actor no autorizado Alta 7,5 < 2.4.9 2.4.9 2019-05-08
Gravity Forms [gravityforms] < 2.0.7 Desconocido < 2.0.7 2.0.7 2016-09-07
Gravity Forms [gravityforms] < 1.9.16 Desconocido < 1.9.16 1.9.16 2016-03-01
Gravity Forms [gravityforms] < 1.9.7 Desconocido < 1.9.7 1.9.7 2015-04-20
Gravity Forms [gravityforms] < 1.8.20 Desconocido < 1.8.20 1.8.20 2015-02-26
CVE-2015-2260 Gravity Forms [gravityforms] >= 1.8 - <= 1.9.3.5 Desconocido 1.8–1.9.3.5 1.9.3.5 0000-00-00
CVE-2026-4394 Gravity Forms [gravityforms] < 2.9.31 Media 6,1 < 2.9.31 2.9.31 0000-00-00
CVE-2026-4406 Gravity Forms [gravityforms] < 2.9.31 Media 4,7 < 2.9.31 2.9.31 0000-00-00
CVE-2026-3492 Gravity Forms [gravityforms] < 2.9.29 Desconocido < 2.9.29 2.9.29 0000-00-00
Gravity Forms [gravityforms] < 2.0.7 Desconocido < 2.0.7 2.0.7
Gravity Forms [gravityforms] < 1.9.16 Desconocido < 1.9.16 1.9.16
Gravity Forms [gravityforms] < 1.9.7 Desconocido < 1.9.7 1.9.7
Gravity Forms [gravityforms] < 1.9.3.6 Desconocido < 1.9.3.6 1.9.3.6
Gravity Forms [gravityforms] < 1.8.20 Desconocido < 1.8.20 1.8.20

CVE-2025-12974

The Gravity Forms plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the legacy chunked upload mechanism in all versions up to, and including, 2.9.21.1. This is due to the extension blacklist not including .phar files, which can be uploaded through the chunked upload mechanism. This makes it possible for unauthenticated attackers to upload executable .phar files and achieve remote code execution on the server, granted they can discover or enumerate the upload path. In order for an attacker to achieve RCE, the web server needs to be set up to process .phar file as PHP via file handler mapping or similar.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2025-12352

The Gravity Forms plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the copy_post_image() function in all versions up to, and including, 2.9.20. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. This only impacts sites that have allow_url_fopen set to `On`, the post creation form enabled along with a file upload field for the post

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2024-13377

The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘alt’ parameter in all versions up to, and including, 2.9.1.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2024-13378

The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘style_settings’ parameter in versions 2.9.0.1 up to, and including, 2.9.1.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The attack is only successful in the Chrome web browser, and requires directly browsing the media file via the attachment post.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

Gravity Forms [gravityforms] < 2.0.7

Update the plugin. An unknown person discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Gravity Forms Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 2.0.7.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2023-2701

Update the WordPress Gravity Forms plugin to the latest available version (at least 2.7.5). Fioravante Souza (WPScan) discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Gravity Forms Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 2.7.5.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

Gravity Forms [gravityforms] < 1.8.20

Upgrade the plugin. Abk Khan discovered and reported this Local File Inclusion vulnerability in WordPress Gravity Forms Plugin. This could allow a malicious actor to include local files of the target website and show its output onto the screen. Files which store credentials, such as database credentials, could potentially allow complete database takeover depending on the configuration. This vulnerability has been fixed in version 1.8.20.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2023-28782

The Gravity Forms plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 2.7.3 via deserialization of untrusted input in the get_field_input function. This allows unauthenticated attackers to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

Gravity Forms [gravityforms] < 1.9.7

Update the plugin to the latest version. An unknown person discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Gravity Forms Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 1.9.7.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

Gravity Forms [gravityforms] < 1.9.3.6

Update the plugin. An unknown person discovered and reported this SQL Injection vulnerability in WordPress Gravity Forms Plugin. This could allow a malicious actor to directly interact with your database, including but not limited to stealing information. This vulnerability has been fixed in version 1.9.3.6.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

Gravity Forms [gravityforms] < 1.9.16

Update the plugin. Henri Salo discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Gravity Forms Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 1.9.16.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2020-13764

common.php in the Gravity Forms plugin before 2.4.9 for WordPress can leak hashed passwords because user_pass is not considered a special case for a $current_user->get($property) call.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

Gravity Forms [gravityforms] < 2.0.7

WordPress Plugin Gravity Forms is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. WordPress Plugin Gravity Forms version 2.0.6.5 is vulnerable; prior versions may also be affected.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

Gravity Forms [gravityforms] < 1.9.16

The Gravityforms plugin for WordPress is vulnerable to Reflected Cross-Site Scripting up to, and including, 1.9.15.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

Gravity Forms [gravityforms] < 1.9.7

The Gravityforms plugin for WordPress is vulnerable to Cross-Site Scripting in versions up to, and including, 1.9.6 due to insufficient input sanitization and output escaping alongside the use of add_query_arg or remove_query_arg(). This makes it possible for attackers to inject arbitrary web scripts that execute in a victim's browser.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

Gravity Forms [gravityforms] < 1.8.20

The Gravityforms plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation via the includes/upload.php file in versions up to, and including, 1.8.19. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2015-2260

The Gravifyforms plugin for WordPress is vulnerable to blind SQL Injection via the ‘sort_column GET’ parameter in versions up to, and including,1.9.3.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2026-4394

The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Credit Card field's 'Card Type' sub-field (`input_<id>.4`) in all versions up to, and including, 2.9.30. This is due to the `get_value_entry_detail()` method in the `GF_Field_CreditCard` class outputting the card type value without escaping, combined with `get_value_save_entry()` accepting and storing unsanitized user input for the `input_<id>.4` parameter. The Card Type field is not rendered on the frontend form (it is normally derived from the card number), but the backend submission parser blindly accepts it if included in the POST request. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute when an administrator views the form entry in the WordPress dashboard.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2026-4406

The Gravity Forms plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `form_ids` parameter in the `gform_get_config` AJAX action in all versions up to, and including, 2.9.30. This is due to the `GFCommon::send_json()` method outputting JSON-encoded data wrapped in HTML comment delimiters using `echo` and `wp_die()`, which serves the response with a `Content-Type: text/html` header instead of `application/json`. The `wp_json_encode()` function does not HTML-encode angle brackets within JSON string values, allowing injected HTML/script tags in `form_ids` array values to be parsed and executed by the browser. The required `config_nonce` is generated with `wp_create_nonce('gform_config_ajax')` and is publicly embedded on every page that renders a Gravity Forms form, making it identical for all unauthenticated visitors within the same 12-hour nonce tick. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This vulnerability cannot be exploited against users who are authenticated on the target system, but could be used to alter the target page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2026-3492

The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.9.28.1. This is due to a compound failure involving missing authorization on the `create_from_template` AJAX endpoint (allowing any authenticated user to create forms), insufficient input sanitization (`sanitize_text_field()` preserves single quotes), and missing output escaping when the form title is rendered in the Form Switcher dropdown (`title` attribute constructed without `esc_attr()`, and JavaScript `saferHtml` utility only escapes `&`, `<`, `>` but not quotes). This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary JavaScript that executes when an Administrator searches in the Form Switcher dropdown in the Form Editor.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

Gravity Forms [gravityforms] < 2.0.7

A blind XSS vulnerability exists in the GravityForms plugin prior to version 2.0.7, in the select option dropdown boxes on forms. If the select column is displayed on the gf_entries page when viewed in the Dashboard, the code is executed by the admin / viewer of the submissions. This vulnerability was responsibly disclosed to the vendor, with documentation, images, and proof of concept. Version 2.0.7 was delivered to the researcher to confirm the vulnerability had been patched, and an adequate timeframe was agreed upon with the vendor before public disclosure, to allow customers time to update their installations.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: WPScan

Gravity Forms [gravityforms] < 1.9.16

The gravityforms WordPress plugin was affected by a Authenticated Reflected Cross-Site Scripting (XSS) security vulnerability.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: WPScan

Gravity Forms [gravityforms] < 1.9.7

The gravityforms WordPress plugin was affected by a Cross-Site Scripting (XSS) security vulnerability.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: WPScan

Gravity Forms [gravityforms] < 1.9.3.6

Title: Gravity Forms 1.8 <= 1.9.3.5 - Blind SQL Injection CVE-2015-2260 Version/s Tested: 1.9.3.1 Description: Gravity Forms is one of the most popular WordPress plugins (gravityforms) used to create forms for WordPress sites. The latest version at the time of writing (1.9.3.5) contains an authenticated (admin, or user with gravityforms_edit_forms capability) Blind SQL Injection vulnerability. The plugin is one of the most popular plugins for the WordPress platform. Technical Description: The authenticated Blind SQL Injection vulnerability can be found within the 'form_list.php' and ‘forms_model’ files. The sort_column GET parameter is not sufficiently sanitised before being used within an SQL query. form_list.php line 106: $sort_column = empty( $_GET['sort'] ) ? 'title' : $_GET['sort']; form_list.php line 111: $forms = RGFormsModel::get_forms( $active, $sort_column, $sort_direction, $trash ); forms_model.php line 106: $sort_column = ESC_SQL( $sort_column ); $order_by = ! empty( $sort_column ) ? "ORDER BY $sort_column $sort_keyword" : ''; $sql = "SELECT f.id, f.title, f.date_created, f.is_active, 0 as lead_count, 0 view_count FROM $form_table_name f $where_clause $order_by"; According to WordPress this function 'Prepares a string for use as an SQL query. A glorified addslashes() that works with arrays.'. However, this is not sufficient to prevent SQL Injection as can be seen from the Proof of Concept. Proof of Concept (PoC) The following GET request will cause the SQL query to execute and sleep for 10 seconds if clicked on as an authenticated admin or other user with gravityforms_edit_forms capability. http://localhost/wp-admin/admin.php?page=gf_edit_forms&sort=date_created%2c(select%20*%20from%20(select(sleep(10)))a) Impact: The original impact has been amended after further research by Ryan Dewhurst. Due to WordPress using X-Frame-Options and PHP/MySQL not supporting stacked queries, it is not currently possible to exploit this vulnerability by a remote attacker via CSRF. A reliable cross-domain timing attack using a GET request which does not rely on frames would be required to exploit this issue. Fix for 1.8 branch: After form_list.php line 106: $sort_column = empty( $_GET['sort'] ) ? 'title' : $_GET['sort']; Add: if ( ! in_array( strtolower( $sort_column ), array( 'id', 'title', 'date_created', 'is_active', 'is_trash' ) ) ) { $sort_column = 'title'; } Timeline: March 13th: 2030 CST: Vulnerability Discovered by Scott Kingsley Clark (10up.com) and vendor notified. March 13th 2300 GMT-5: Review, exploit and temporary patch written by Ivan Kruchkoff (10up.com). March 14th: Vendor releases 1.9.3.6 March 17th: Advisory released. Credits: Ryan Dewhurst (WPScan Team - Dewhurst Security) for PoC / writeup of WP SEO exploit: CVE-2015-2292, CVE-2015-2293

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: WPScan

Gravity Forms [gravityforms] < 1.8.20

The gravityforms WordPress plugin was affected by an Arbitrary File Upload security vulnerability.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: WPScan

Cómo solucionarlo

Actualiza este plugin a la última versión de wordpress.org — cada CVE de arriba indica la versión exacta que lo corrigió ("Corregido en") cuando hay una registrada.

Este es el historial completo de vulnerabilidades conocidas del plugin, no un escaneo de una instalación específica — ejecuta un escaneo gratis de tu propio sitio para verificar tu versión instalada exacta.

Alternativas más seguras / más establecidas

Verifica tu propio sitio WordPress

Ejecuta un escaneo pasivo gratis ahora, o crea una cuenta gratuita e instala el plugin de WP Clinic para un escaneo profundo de toda tu cuenta de hosting y reparación asistida por IA.