Executive brief
Gravity Forms, a popular WordPress plugin for creating web forms, contains a security flaw in its credit card field component. An attacker can submit a specially crafted form entry that includes malicious code. If a site administrator later views this entry in the WordPress dashboard, the code will execute in their browser, potentially allowing the attacker to perform unauthorized actions or steal sensitive session information.
Technical details
A Stored Cross-Site Scripting (XSS) vulnerability exists in Gravity Forms due to insufficient input sanitization and output escaping in the Credit Card field. Specifically, the `get_value_save_entry()` method in the `GF_Field_CreditCard` class accepts unsanitized user input for the `input_<id>.4` (Card Type) parameter, and the `get_value_entry_detail()` method outputs this value without escaping. Although the 'Card Type' field is not typically rendered on the frontend, the backend submission parser accepts it via POST requests. An unauthenticated attacker can exploit this to inject arbitrary JavaScript. The vulnerability is patched in version 2.9.31.
Affected products
- Gravity Forms Gravity Forms <= 2.9.30
Timeline
- 2026-03-19: other: Last vulnerable version (2.9.30) released
- 2026-04-02: patched: Version 2.9.31 released with security enhancements
- 2026-04-08: disclosed: Public advisory published
References
- https://docs.gravityforms.com/gravityforms-change-log/
- https://plugins.trac.wordpress.org/browser/gravityforms/tags/2.9.25/includes/fields/class-gf-field-creditcard.php
- https://plugins.trac.wordpress.org/browser/gravityforms/tags/2.9.25/includes/fields/class-gf-field-creditcard.php
- https://plugins.trac.wordpress.org/browser/gravityforms/trunk/includes/fields/class-gf-field-creditcard.php
- https://plugins.trac.wordpress.org/browser/gravityforms/trunk/includes/fields/class-gf-field-creditcard.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/6f38d7b7-6df6-47a2-a9ba-87ef1f039e44?source=cve