WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
gravity-forms-sticky-list
Published
2019-02-26
Title
Freemius Library < 2.2.4 - Subscriber+ Arbitrary Option Update
Slug
gravity-forms-sticky-list
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
gravity-forms-toolbar
Published
2024-09-30
Title
Gravity Forms Toolbar <= 1.7.0 - Reflected Cross-Site Scripting
Slug
gravity-signature-forms-add-on
Published
2025-12-31
Title
Signature Add-On for Gravity Forms < 1.8.7 - Missing Authorization
Slug
gravityforms
Published
2014-12-08
Title
Gravity Forms <= 1.8.19 - Arbitrary File Upload
Slug
gravityforms
Published
2015-03-17
Title
Gravity Forms 1.8 <= 1.9.3.5 - Authenticated Blind SQL Injection
Slug
gravityforms
Published
2015-04-20
Title
Gravity Forms <= 1.9.6 - Cross-Site Scripting (XSS)
Slug
gravityforms
Published
2016-03-01
Title
Gravity Forms < 1.9.16 - Authenticated Reflected Cross-Site Scripting (XSS)
Slug
gravityforms
Published
2016-10-13
Title
Gravity Forms < 2.0.7 - Authenticated Blind Cross-Site Scripting (XSS)
Slug
gravityforms
Published
2019-05-08
Title
GravityForms < 2.4.9 - Hashed Password Leakage
Slug
gravityforms
Published
2023-05-29
Title
Gravity Forms < 2.7.4 - Unauthenticated PHP Object Injection
Slug
gravityforms
Published
2023-06-21
Title
Gravity Forms < 2.7.5 - Reflected XSS
Slug
gravityforms
Published
2025-01-16
Title
GravityForms 2.9.0.1 - 2.9.1.3 - Unauthenticated Stored Cross-Site Scripting via 'style_settings' parameter
Slug
gravityforms
Published
2025-01-16
Title
GravityForms < 2.9.2 - Unauthenticated Stored Cross-Site Scripting via 'alt' parameter
Slug
gravityforms
Published
2025-07-11
Title
GravityForms 2.9.11.1 / 2.9.12 - Malware Compromise
Slug
gravityforms
Published
2025-11-06
Title
Gravity Forms 2.9.18 - 2.9.20 - Unauthenticated Arbitrary File Upload via 'copy_post_image'
Slug
gravityforms
Published
2025-11-17
Title
Gravity Forms < 2.9.22 - Unauthenticated Arbitrary File Upload via Legacy Chunked Upload
Slug
gravityforms
Published
2025-12-03
Title
GravityForms < 2.9.23.1 - Unauthenticated Arbitrary File Upload
Slug
gravityforms
Published
2026-03-10
Title
Gravity Forms < 2.9.29 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Form Title
Slug
gravityforms
Published
2026-04-07
Title
Gravity Forms < 2.9.31 - Reflected Cross-Site Scripting via 'form_ids' Parameter
Slug
gravityforms
Published
2026-04-07
Title
Gravity Forms < 2.9.31 - Unauthenticated Stored Cross-Site Scripting via Credit Card 'Card Type' Sub-Field
Slug
gravityformswebhooks
Published
2025-04-30
Title
Gravity Forms WebHooks < 1.7.0 - Authenticated (Admin+) Server-Side Request Forgery via Webhook
Slug
gravitysmtp
Published
2026-03-30
Title
Gravity SMTP < 2.1.5 - Unauthenticated Sensitive Information Exposure via REST API
Slug
gravitysmtp
Published
2026-04-09
Title
Gravity SMTP < 2.1.5 - Subscriber+ Plugin Uninstall
Slug
gravitywp-merge-tags
Published
2025-08-08
Title
GravityWP - Merge Tags < 1.4.5 - Unauthenticated Local File Inclusion