# CVE-2026-4406: Gravity Forms Reflected XSS in gform_get_config AJAX action

Source: https://junglewise.ai/threats/cve-2026-4406-gravity-forms-reflected-xss-in-gform-get-config-ajax-action  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-08. Updated: 2026-07-25  
License: CC BY 4.0 with a link back

CVE-2026-4406 · Severity: medium · CVSS 4.7 · Published 2026-04-08

Gravity Forms is a popular WordPress plugin used to create and manage web forms. A security vulnerability allows unauthenticated attackers to inject malicious scripts into a web page if they can trick a user into clicking a specific link. While this cannot be used to directly steal data from logged-in users, it can be used to alter the appearance of the page or redirect visitors to malicious sites.

## Quick answers

**Is CVE-2026-4406 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-4406 being exploited in the wild.

**How severe is CVE-2026-4406?** Medium severity, with a CVSS score of 4.7, published 8 April 2026.

**Which products and versions are affected?** Gravity Forms Gravity Forms <= 2.9.30.

**Is there a fix for CVE-2026-4406?** A patch was published on 2026-04-02: Fixed in version 2.9.31 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-4406 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-4406?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a Reflected Cross-Site Scripting (XSS) flaw within the `gform_get_config` AJAX action. The root cause is the `GFCommon::send_json()` method, which outputs JSON-encoded data wrapped in HTML comment delimiters using `echo` and `wp_die()`, causing the browser to interpret the response as `text/html` instead of `application/json`. Because `wp_json_encode()` does not escape angle brackets, an attacker can inject script tags into the `form_ids` array. Exploitation requires a valid `config_nonce`, which is publicly accessible on any page rendering a form and remains valid for 12 hours. An unauthenticated attacker can execute arbitrary JavaScript in the context of a victim's browser via a crafted link, though the impact is limited to unauthenticated sessions. The issue was addressed in version 2.9.31.

## Affected products

- Gravity Forms Gravity Forms <= 2.9.30

## Timeline

- 2026-03-19: other: Last vulnerable version (2.9.30) released
- 2026-04-02: patched: Fixed in version 2.9.31
- 2026-04-08: disclosed: CVE published

## References

- [https://docs.gravityforms.com/gravityforms-change-log/](https://docs.gravityforms.com/gravityforms-change-log/)
- [https://plugins.trac.wordpress.org/browser/gravityforms/trunk/common.php](https://plugins.trac.wordpress.org/browser/gravityforms/trunk/common.php)
- [https://plugins.trac.wordpress.org/browser/gravityforms/trunk/includes/config/class-gf-config-collection.php](https://plugins.trac.wordpress.org/browser/gravityforms/trunk/includes/config/class-gf-config-collection.php)
- [https://plugins.trac.wordpress.org/browser/gravityforms/trunk/includes/config/class-gf-config-service-provider.php](https://plugins.trac.wordpress.org/browser/gravityforms/trunk/includes/config/class-gf-config-service-provider.php)
- [https://plugins.trac.wordpress.org/browser/gravityforms/trunk/includes/config/items/class-gf-config-global.php](https://plugins.trac.wordpress.org/browser/gravityforms/trunk/includes/config/items/class-gf-config-global.php)
- [https://www.wordfence.com/threat-intel/vulnerabilities/id/4126d452-65a9-48f5-a3f5-5be1b8fff80c?source=cve](https://www.wordfence.com/threat-intel/vulnerabilities/id/4126d452-65a9-48f5-a3f5-5be1b8fff80c?source=cve)