Plugin icon

Gravity Forms

gravityforms

Vulnerabilities:

14

Last Updated:

January 9, 2026

Active Installs:

n/a

Published
Title
Fixed in
CVSS
Published
2025-12-03
Title
GravityForms < 2.9.23.1 - Unauthenticated Arbitrary File Upload
Fixed in
Fixed in 2.9.23.1
CVSS
9.0 (critical)
Published
2025-11-17
Title
Gravity Forms < 2.9.22 - Unauthenticated Arbitrary File Upload via Legacy Chunked Upload
Fixed in
Fixed in 2.9.22
CVSS
8.1 (high)
Published
2025-11-06
Title
Gravity Forms 2.9.18 - 2.9.20 - Unauthenticated Arbitrary File Upload via 'copy_post_image'
Fixed in
Fixed in 2.9.21
CVSS
8.1 (high)
Published
2025-07-11
Title
GravityForms 2.9.11.1 / 2.9.12 - Malware Compromise
Fixed in
Fixed in 2.9.13
CVSS
9.8 (critical)
Published
2025-01-16
Title
GravityForms 2.9.0.1 - 2.9.1.3 - Unauthenticated Stored Cross-Site Scripting via 'style_settings' parameter
Fixed in
Fixed in 2.9.2
CVSS
5.4 (medium)
Published
2025-01-16
Title
GravityForms < 2.9.2 - Unauthenticated Stored Cross-Site Scripting via 'alt' parameter
Fixed in
Fixed in 2.9.2
CVSS
7.5 (high)
Published
2023-06-21
Title
Gravity Forms < 2.7.5 - Reflected XSS
Fixed in
Fixed in 2.7.5
CVSS
7.1 (high)
Published
2023-05-29
Title
Gravity Forms < 2.7.4 - Unauthenticated PHP Object Injection
Fixed in
Fixed in 2.7.4
CVSS
8.1 (high)
Published
2019-05-08
Title
GravityForms < 2.4.9 - Hashed Password Leakage
Fixed in
Fixed in 2.4.9
CVSS
2.7 (low)
Published
2016-10-13
Title
Gravity Forms < 2.0.7 - Authenticated Blind Cross-Site Scripting (XSS)
Fixed in
Fixed in 2.0.7
CVSS
n/a
Published
2016-03-01
Title
Gravity Forms < 1.9.16 - Authenticated Reflected Cross-Site Scripting (XSS)
Fixed in
Fixed in 1.9.16
CVSS
n/a
Published
2015-04-20
Title
Gravity Forms <= 1.9.6 - Cross-Site Scripting (XSS)
Fixed in
Fixed in 1.9.7
CVSS
n/a
Published
2015-03-17
Title
Gravity Forms 1.8 <= 1.9.3.5 - Authenticated Blind SQL Injection
Fixed in
Fixed in 1.9.3.6
CVSS
n/a
Published
2014-12-08
Title
Gravity Forms <= 1.8.19 - Arbitrary File Upload
Fixed in
Fixed in 1.8.20
CVSS
n/a