CVE-2026-5112

The Gravity Forms plugin for WordPress contains a security flaw in versions up to 2.10.0, allowing malicious code to be injected into product names of Calculation Product fields within Repeater fields. The issue arises from inadequate validation and sanitization procedures, which permit untrusted input to bypass standard safety checks. As a result, when an administrator views entry details, the injected script can be executed without further restrictions.

Based on public CVE data (MITRE/NVD).