Is Gravityforms safe?

Plugin details

• Slug: gravityforms

Known vulnerabilities

• CVE-2020-13764 — Gravity Forms [gravityforms] < 2.4.9 (CWE-200) · High
• Gravity Forms [gravityforms] < 2.0.7
• Gravity Forms [gravityforms] < 1.9.16
• Gravity Forms [gravityforms] < 1.9.7
• CVE-2015-2260 — Gravity Forms [gravityforms] >= 1.8 - <= 1.9.3.5

+ 28 more known vulnerabilities

• Gravity Forms [gravityforms] < 1.8.20
• Gravity Forms [gravityforms] < 2.0.7
• Gravity Forms [gravityforms] < 1.9.16
• Gravity Forms [gravityforms] < 1.9.7
• Gravity Forms [gravityforms] < 1.9.3.6
• Gravity Forms [gravityforms] < 1.8.20
• CVE-2023-28782 — Gravity Forms [gravityforms] < 2.7.4 (Insecure Deserialization) · High
• CVE-2023-2701 — Gravity Forms [gravityforms] < 2.7.5 (XSS) · Medium
• Gravity Forms [gravityforms] < 1.9.3.6
• Gravity Forms [gravityforms] < 1.9.7
• Gravity Forms [gravityforms] < 1.9.16
• Gravity Forms [gravityforms] < 1.8.20
• Gravity Forms [gravityforms] < 2.0.7
• CVE-2024-13377 — Gravity Forms [gravityforms] < 2.9.2 (XSS) · High
• CVE-2024-13378 — Gravity Forms [gravityforms] < 2.9.2 (XSS) · Medium
• CVE-2025-12352 — Gravity Forms [gravityforms] < 2.9.21 (Unrestricted File Upload) · Critical
• CVE-2025-12974 — Gravity Forms [gravityforms] < 2.9.22 (Unrestricted File Upload) · High
• CVE-2025-13407 — Gravity Forms [gravityforms] < 2.9.23.1 (Unrestricted File Upload) · Medium
• CVE-2026-4394 — Gravity Forms [gravityforms] < 2.9.31 · Medium
• CVE-2026-4406 — Gravity Forms [gravityforms] < 2.9.31 · Medium
• CVE-2026-3492 — Gravity Forms [gravityforms] < 2.9.29
• CVE-2026-5111 — Gravity Forms [gravityforms] < 2.10.1 (XSS) · High
• CVE-2026-5110 — Gravity Forms [gravityforms] < 2.10.1 (XSS) · High
• CVE-2026-5113 — Gravity Forms [gravityforms] < 2.10.1 (XSS) · High
• CVE-2026-5112 — Gravity Forms [gravityforms] < 2.10.1 (XSS) · High
• CVE-2026-5109 — Gravity Forms [gravityforms] < 2.10.1 (XSS) · High
• CVE-2026-48866 — Gravity Forms [gravityforms] < 2.10.1 (Path Traversal) · Critical
• CVE-2026-12997 — Gravity Forms [gravityforms] < 2.10.5 (Path Traversal) · High

Vulnerabilities are matched against the exact installed version when it's known. Always keep the plugin updated to the latest release.

Safer / more established alternatives

• Advanced Custom Fields (ACF®) — 2000000+ active installs — max PHP 8.4
• ACF Content Analysis for Yoast SEO — 100000+ active installs — max PHP 8.4
• Advanced Custom Fields: Extended — 100000+ active installs — max PHP <8.0
• Advanced Custom Fields: Font Awesome Field — 90000+ active installs — max PHP 8.4
• ACF Photo Gallery Field — 60000+ active installs