Gravity Forms

Vulnerabilities 31Slug gravityformsPlugin page →

Minimum safe version

2.10.1

Update to 2.10.1 or later to address 30 fixable vulnerabilities

Affected up to1.9.3.5 ⚠
N/A
2026-03-10< 2.9.29

Gravity Forms <= 2.9.28.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Form Title

WordfenceCVE
Medium 4.7
2026-04-08< 2.9.31

Gravity Forms <= 2.9.30 - Reflected Cross-Site Scripting via 'form_ids' Parameter

EUVDWordfenceCVE
Medium 6.1
2026-04-08< 2.9.31

Gravity Forms <= 2.9.30 - Unauthenticated Stored Cross-Site Scripting via Credit Card 'Card Type' Sub-Field

EUVDWordfenceCVE
Medium 6.8
2025-12-24< 2.9.23.1

CVE-2025-13407

CVEWordfence
Critical 9.8
2025-11-07< 2.9.21

CVE-2025-12352

CVEWordfence
N/A
2023-10-13< 2.0.7

WordPress Gravity Forms Plugin <= 2.0.6.5 is vulnerable to Cross Site Scripting (XSS)

Patchstack
N/A
2023-06-17< 1.8.20

WordPress Gravity Forms Plugin <= 1.8.19 is vulnerable to Local File Inclusion

Patchstack
N/A
2023-03-01< 1.9.16

WordPress Gravity Forms Plugin <= 1.9.15.11 is vulnerable to Cross Site Scripting (XSS)

Patchstack
N/A
2023-04-20< 1.9.7

WordPress Gravity Forms Plugin <= 1.9.6 is vulnerable to Cross Site Scripting (XSS)

Patchstack
N/A
2023-03-17< 1.9.3.6

WordPress Gravity Forms Plugin <= 1.9.3.5 is vulnerable to SQL Injection

Patchstack
N/A
< 1.8.20

Gravity Forms &lt;= 1.8.19 - Arbitrary File Upload

WPScan
N/A
< 1.9.3.6

Gravity Forms 1.8 &lt;= 1.9.3.5 - Authenticated Blind SQL Injection

WPScan
N/A
< 1.9.7

Gravity Forms &lt;= 1.9.6 - Cross-Site Scripting (XSS)

WPScan
N/A
< 1.9.16

Gravity Forms &lt;= 1.9.15.11 - Authenticated Reflected Cross-Site Scripting (XSS)

WPScan
N/A
< 2.0.7

Gravity Forms &lt;= 2.0.6.5 - Authenticated Blind Cross-Site Scripting (XSS)

WPScan
N/A
2015-02-26< 1.8.20

Gravityforms <= 1.8.19 - Arbitrary File Upload

Wordfence
N/A
2015-03-17≥ 1.8 and ≤ 1.9.3.5

Gravityforms <= 1.9.3.5 - SQL Injection

WordfenceCVE
N/A
2015-04-20< 1.9.7

Gravityforms <= 1.9.6 - Cross-Site Scripting

Wordfence
N/A
2016-03-01< 1.9.16

Gravityforms <= 1.9.15.11 - Cross-Site Scripting

Wordfence
N/A
2016-09-07< 2.0.7

Gravity Forms <= 2.0.6.5 - Cross-Site Scripting

Wordfence