CVE-2026-5110

The Gravity Forms plugin for WordPress has a vulnerability in versions up to 2.10.0 that allows an attacker to inject malicious code into a product name field. This occurs when a SingleProduct field is nested inside a Repeater field, allowing the attacker to bypass normal validation checks. The malicious code is then stored in the database without being sanitized, and when an administrator views the entry, the code is executed in their browser, potentially allowing the attacker to inject arbitrary web scripts.

Based on public CVE data (MITRE/NVD).