CVE-2026-5113

A security flaw exists in Gravity Forms plugin versions up to 2.10.0, which can be exploited by injecting malicious code through hidden inputs in the Consent field. The issue arises from a faulty validation process that allows unsanitized input to be stored when sanitized and raw values of certain tags are identical, such as those stripped by wp_kses(). This vulnerability enables unauthenticated attackers to inject arbitrary web scripts into entries, which will execute when an authenticated administrator views the Entries List page.

Based on public CVE data (MITRE/NVD).