Is CVE-2026-4394 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-4394 being exploited in the wild.

How severe is CVE-2026-4394?

Medium severity, with a CVSS score of 6.1, published 8 April 2026.

Which products and versions are affected?

Gravity Forms Gravity Forms <= 2.9.30.

Is there a fix for CVE-2026-4394?

A patch was published on 2026-04-02: Version 2.9.31 released with security enhancements Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-4394 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-4394?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-4394: Gravity Forms Stored XSS in Credit Card field

Q: Is there a fix for CVE-2026-4394?

A patch was published on 2026-04-02: Version 2.9.31 released with security enhancements Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-4394 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-4394?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-4394 · Severity: medium · CVSS 6.1 · Published 2026-04-08

Gravity Forms, a popular WordPress plugin for creating web forms, contains a security flaw in its credit card field component. An attacker can submit a specially crafted form entry that includes malicious code. If a site administrator later views this entry in the WordPress dashboard, the code will execute in their browser, potentially allowing the attacker to perform unauthorized actions or steal sensitive session information.

Quick answers

Is CVE-2026-4394 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-4394 being exploited in the wild.
How severe is CVE-2026-4394?: Medium severity, with a CVSS score of 6.1, published 8 April 2026.
Which products and versions are affected?: Gravity Forms Gravity Forms <= 2.9.30.
Is there a fix for CVE-2026-4394?: A patch was published on 2026-04-02: Version 2.9.31 released with security enhancements Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-4394 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-4394?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Stored Cross-Site Scripting (XSS) vulnerability exists in Gravity Forms due to insufficient input sanitization and output escaping in the Credit Card field. Specifically, the `get_value_save_entry()` method in the `GF_Field_CreditCard` class accepts unsanitized user input for the `input_<id>.4` (Card Type) parameter, and the `get_value_entry_detail()` method outputs this value without escaping. Although the 'Card Type' field is not typically rendered on the frontend, the backend submission parser accepts it via POST requests. An unauthenticated attacker can exploit this to inject arbitrary JavaScript. The vulnerability is patched in version 2.9.31.

Affected products

Gravity Forms Gravity Forms <= 2.9.30

Timeline

2026-03-19: other: Last vulnerable version (2.9.30) released
2026-04-02: patched: Version 2.9.31 released with security enhancements
2026-04-08: disclosed: Public advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.