Chaque version est nettoyée, comparée au code de licence de l’éditeur et analysée avant d’être intégrée au dépôt. Une version qui échoue n’est pas publiée.
Versions publiées0
Fichiers analysés0
Résultats examinés0
Versions retenues78
Retenues : archives de cette extension qui n’ont pas passé les contrôles automatiques et ne sont pas publiées. Résultats examinés : correspondances des règles qui ont été vérifiées et résolues avant la publication.
Comment chaque version est contrôlée
Analyse des logiciels malveillantsClamAV
Chaque fichier de chaque version comparé à la base de signatures ClamAV.
Règles de motifsYARA
Web shells, chargeurs obfusqués, PHP encodé et motifs de nulling connus (php-malware-finder plus des règles MeteorGPL).
Analyse PHPHeuristiques
Analyse au niveau des tokens : inclusions distantes, entrées de requête atteignant des fonctions shell, décodeurs alimentant eval, PHP caché dans des images, des polices ou des archives, remplacement des gestionnaires du serveur.
Intégrité de la licenceSignatures de-null
Le code de licence, d’activation et de mise à jour est comparé au code de l’éditeur et à la version précédente ; un code de licence modifié n’est jamais publié.
Syntaxe PHPLint PHP
Chaque fichier PHP s’analyse sans erreur avec la version de PHP prise en charge par le dépôt.
Politique des ressources0 image remplacée · 0 fichier supprimé
Les illustrations, polices, médias et contenus de démonstration susceptibles d’être soumis à une licence distincte sont remplacés par des substituts ou supprimés.
Analyses par version
Version
Analyse
Des dossiers
Signatures ClamAV
Résultats examinés
Ressources remplacées
Durée
Résultat
Politique de sécurité
Signaler une vulnérabilité. Les problèmes de sécurité dans le code propre de l’extension relèvent de l’éditeur, Gravity Forms ; signalez-les-lui. Les problèmes liés à un paquet tel que ce dépôt le distribue — un fichier qui ne devrait pas s’y trouver, une analyse qui a laissé passer quelque chose — sont à signaler à packages@meteorgpl.com et reçoivent une réponse sous 48 heures.
Ce qui se passe en cas de détection. Les versions concernées sont retirées du dépôt, les personnes qui suivent le paquet sont prévenues, et une version corrigée est publiée dès qu’une version passe tous les contrôles.
Titulaires de droits. La politique de retrait décrit comment un paquet est retiré.
Vulnérabilités connues
Signalements publics de vulnérabilités pour Gravity Forms, les versions concernées et la version de ce dépôt qui les corrige. Les personnes qui suivent le paquet et les comptes dont on sait qu’ils utilisent une version concernée sont alertés.
L’éditeur l’a corrigée dans 3.1.2 ; cette version n’est pas encore dans le dépôt.
Aucune version de ce dépôt n’est concernée.
Détails
The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Post Excerpt / Post Custom Field / Rich-Text Paragraph Field Values in all versions up to, and including, 3.1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is possible because Post Excerpt, Post Custom Field, and Rich-Text-Editor-enabled Paragraph Text fields allow raw HTML submissions via allow_html(), and an entity-encoded payload stored in a data-dialog-confirm attribute evades wp_kses_post() at save time but is decoded into executable markup by the browser when the plugin's admin JavaScript passes the attribute value to insertAdjacentHTML().
Correction: Update to version 3.1.2, or a newer patched version
CWE-79: Improper Neutralization of Input During Web Page Generation
L’éditeur l’a corrigée dans 3.1.3 ; cette version n’est pas encore dans le dépôt.
Aucune version de ce dépôt n’est concernée.
Détails
The Gravity Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.1.2 via a Post Custom Field whose input type is List. This is due to GFFormsModel::create_post() passing the submitted value to WordPress' unrestricted global maybe_unserialize() rather than the plugin's own hardened GFCommon::maybe_unserialize(), which was added in 3.1.1 and passes allowed_classes => false precisely to prevent object instantiation. Where the field has a content template enabled, the submitted row reaches that call verbatim. This makes it possible for unauthenticated attackers to inject a PHP object into post meta. No PHP Object Injection gadget chain is present in the plugin itself; however, if a gadget chain is present via an additional plugin or theme, it could allow the attacker to perform actions such as remote code execution. Where the custom field is mapped to the protected _wp_page_template meta key, WordPress itself supplies the chain: validate_file() accepts non-scalars, WP_Theme::__toString() then resolves an attacker-controlled path, and on hosts with a readable PEAR install and register_argc_argv enabled this yields remote code execution.
Correction: Update to version 3.1.3, or a newer patched version
L’éditeur l’a corrigée dans 3.1.3 ; cette version n’est pas encore dans le dépôt.
Aucune version de ce dépôt n’est concernée.
Détails
The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via List Field in all versions up to, and including, 3.1.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires the administrator to click the injected link in the entry detail view and confirm a dialog, which triggers the admin JavaScript bundle's delegated data-dialog-callback handler to invoke the attacker-supplied function reference.
Correction: Update to version 3.1.3, or a newer patched version
CWE-79: Improper Neutralization of Input During Web Page Generation
L’éditeur l’a corrigée dans 3.1.1 ; cette version n’est pas encore dans le dépôt.
Aucune version de ce dépôt n’est concernée.
Détails
The Gravity Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to 3.1.1. This is due to deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
Correction: Update to version 3.1.1, or a newer patched version
L’éditeur l’a corrigée dans 3.1.1 ; cette version n’est pas encore dans le dépôt.
Aucune version de ce dépôt n’est concernée.
Détails
The Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.1.0.4 via the upload_file function. This is due to a mismatch between the field validation pipeline and the file persistence pipeline, where hidden file upload fields bypass extension validation and a rejected file's intact upload state is later passed to upload_file() without re-validation. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. Exploitation requires the targeted form to contain a File Upload field with its Visibility set to 'Hidden'; the vulnerability is reachable by unauthenticated attackers on any publicly accessible form meeting this condition.
Correction: Update to version 3.1.1, or a newer patched version
CWE-434: Unrestricted Upload of File with Dangerous Type
L’éditeur l’a corrigée dans 3.0.0 ; cette version n’est pas encore dans le dépôt.
Aucune version de ce dépôt n’est concernée.
Détails
The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Post Body Field Value in all versions up to, and including, 2.10.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit survives save-time sanitization because wp_kses_post allows the required HTML tags and attributes, and the client-side tooltip script re-parses the browser-decoded aria-label value as innerHTML while only stripping script elements, leaving onerror and other event-handler attributes fully intact and executable.
Correction: Update to version 3.0.0, or a newer patched version
CWE-79: Improper Neutralization of Input During Web Page Generation
L’éditeur l’a corrigée dans 3.0.3 ; cette version n’est pas encore dans le dépôt.
Aucune version de ce dépôt n’est concernée.
Détails
The Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.0.2. This is due to insufficient validation of multi-file upload chunk state in the `GFAsyncUpload::upload()` function, where public form state URL hashes can be reused as chunk continuation hashes and attacker-controlled temporary filenames are accepted before sanitization. This makes it possible for unauthenticated attackers, when a public form contains a File Upload field with Multiple Files enabled, to upload a valid PNG/PDF polyglot to an attacker-selected public `.php` or `.html` filename in the Gravity Forms temporary upload directory. This can lead to remote code execution on WordPress systems that use NGINX or other non `.htaccess` respecting web servers. NOTE: During installation and activation, the Gravity Forms plugin places a `.htaccess` file in this directory, which prevents this vulnerability from being exploited despite the PHP file being written to the temporary upload directory. In these cases where PHP execution is blocked, attacker-written HTML can result in stored same-origin cross-site scripting if a victim visits the generated file URL.
Correction: Update to version 3.0.3, or a newer patched version
CWE-434: Unrestricted Upload of File with Dangerous Type
L’éditeur l’a corrigée dans 2.10.5 ; cette version n’est pas encore dans le dépôt.
Aucune version de ce dépôt n’est concernée.
Détails
The Gravity Forms plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.10.4 via the 'gform_uploaded_files' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Exploitation requires the targeted form to not enforce login (so publicly accessible), which allows the unauthenticated attacker to reach the process_send_resume_link endpoint and supply an arbitrary recipient email address to receive the traversal-retrieved file as a notification attachment.
Correction: Update to version 2.10.5, or a newer patched version
CWE-22: Improper Limitation of a Pathname to a Restricted Directory
L’éditeur l’a corrigée dans 2.10.1 ; cette version n’est pas encore dans le dépôt.
Aucune version de ce dépôt n’est concernée.
Détails
The Gravity Forms plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in all versions up to, and including, 2.10.0.1. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Correction: Update to version 2.10.1, or a newer patched version
CWE-22: Improper Limitation of a Pathname to a Restricted Directory
L’éditeur l’a corrigée dans 2.9.31 ; cette version n’est pas encore dans le dépôt.
Aucune version de ce dépôt n’est concernée.
Détails
The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Consent field hidden inputs in versions up to and including 2.9.30. This is due to a flawed state validation mechanism that fails open when input is sanitized by wp_kses(), combined with insufficient output escaping. The state validation logic creates two hashes (raw input and wp_kses-sanitized input) and only fails validation if BOTH hashes don't match the original state. When an attacker injects XSS payloads using tags stripped by wp_kses() (like <svg>), the sanitized hash matches while the malicious raw value is preserved and saved to the database. When administrators view the Entries List page, the stored malicious consent label is retrieved and output without escaping, causing the XSS payload to execute. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in entries that will execute whenever an authenticated administrator accesses the entries list page.
Correction: Update to version 2.9.31, or a newer patched version
CWE-79: Improper Neutralization of Input During Web Page Generation
L’éditeur l’a corrigée dans 2.10.1 ; cette version n’est pas encore dans le dépôt.
Aucune version de ce dépôt n’est concernée.
Détails
The Gravity Forms plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting in versions up to and including 2.10.0. This is due to insufficient input validation and output escaping of Calculation Product field product names when rendered inside Repeater fields. The validate() method in the GF_Field_Calculation class only validates the quantity field (.3) and completely ignores the product name field (.1), allowing malicious HTML to pass through validation. When the value is saved, the sanitize_entry_value() method returns the raw value without sanitization for fields where HTML is not expected. Subsequently, when an entry is viewed in wp-admin, the get_value_entry_detail() method concatenates the unescaped product name directly into the output string, which is then rendered by the repeater's get_value_entry_detail() method without further escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts via form submissions that will execute whenever an authenticated administrator with the gravityforms_view_entries capability accesses the entry detail page.
Correction: Update to version 2.10.1, or a newer patched version
CWE-79: Improper Neutralization of Input During Web Page Generation
L’éditeur l’a corrigée dans 2.10.1 ; cette version n’est pas encore dans le dépôt.
Aucune version de ce dépôt n’est concernée.
Détails
The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 2.10.0. This is due to insufficient validation and output escaping of Product Option field values. The vulnerability exists because the state validation function accepts submitted values where the wp_kses()-sanitized version matches a legitimate option value, but then stores the raw unsanitized value in the database. When administrators view entry details via the Order Summary section, the option_label is output directly without escaping (view-order-summary.php line 32), executing the injected JavaScript. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in entry data that will execute whenever an administrator accesses the entry details page.
Correction: Update to version 2.10.1, or a newer patched version
CWE-79: Improper Neutralization of Input During Web Page Generation
L’éditeur l’a corrigée dans 2.10.1 ; cette version n’est pas encore dans le dépôt.
Aucune version de ce dépôt n’est concernée.
Détails
The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 2.10.0. This is due to insufficient input validation and output escaping on Hidden Product field values when used inside Repeater fields, where repeater subfields bypass state validation checks and the Hidden Product validate() method only validates the quantity field while ignoring the product name field that is later output without proper escaping in the get_value_entry_detail() method. This makes it possible for unauthenticated attackers to inject arbitrary web scripts through form submissions that will execute whenever an administrator views the entry details.
Correction: Update to version 2.10.1, or a newer patched version
CWE-79: Improper Neutralization of Input During Web Page Generation
L’éditeur l’a corrigée dans 2.10.1 ; cette version n’est pas encore dans le dépôt.
Aucune version de ce dépôt n’est concernée.
Détails
The Gravity Forms plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting in versions up to and including 2.10.0. This is due to insufficient input validation and output escaping in the SingleProduct field when used inside a Repeater field. When SingleProduct fields are nested within Repeater fields, the validation flow bypasses the state validation mechanism (failed_state_validation()) that would normally prevent tampering with field values. The validate_subfield() method only calls the field's validate() method, which for SingleProduct fields only validates the quantity field and does not check the product name field for tampering. As a result, an attacker can inject arbitrary HTML and JavaScript into the product name field (input .1). This malicious input is then saved to the database without sanitization because sanitize_entry_value() returns raw values when HTML is not expected for the field type. When an administrator views the entry in wp-admin/admin.php?page=gf_entries, the get_value_entry_detail() method outputs the product name without escaping, causing the stored XSS payload to execute in the administrator's browser. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever an administrator accesses an entry containing the malicious payload.
Correction: Update to version 2.10.1, or a newer patched version
CWE-79: Improper Neutralization of Input During Web Page Generation
L’éditeur l’a corrigée dans 2.9.31 ; cette version n’est pas encore dans le dépôt.
Aucune version de ce dépôt n’est concernée.
Détails
The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Credit Card field's 'Card Type' sub-field (`input_<id>.4`) in all versions up to, and including, 2.9.30. This is due to the `get_value_entry_detail()` method in the `GF_Field_CreditCard` class outputting the card type value without escaping, combined with `get_value_save_entry()` accepting and storing unsanitized user input for the `input_<id>.4` parameter. The Card Type field is not rendered on the frontend form (it is normally derived from the card number), but the backend submission parser blindly accepts it if included in the POST request. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute when an administrator views the form entry in the WordPress dashboard.
Correction: Update to version 2.9.31, or a newer patched version
CWE-79: Improper Neutralization of Input During Web Page Generation
L’éditeur l’a corrigée dans 2.9.31 ; cette version n’est pas encore dans le dépôt.
Aucune version de ce dépôt n’est concernée.
Détails
The Gravity Forms plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `form_ids` parameter in the `gform_get_config` AJAX action in all versions up to, and including, 2.9.30. This is due to the `GFCommon::send_json()` method outputting JSON-encoded data wrapped in HTML comment delimiters using `echo` and `wp_die()`, which serves the response with a `Content-Type: text/html` header instead of `application/json`. The `wp_json_encode()` function does not HTML-encode angle brackets within JSON string values, allowing injected HTML/script tags in `form_ids` array values to be parsed and executed by the browser. The required `config_nonce` is generated with `wp_create_nonce('gform_config_ajax')` and is publicly embedded on every page that renders a Gravity Forms form, making it identical for all unauthenticated visitors within the same 12-hour nonce tick. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This vulnerability cannot be exploited against users who are authenticated on the target system, but could be used to alter the target page.
Correction: Update to version 2.9.31, or a newer patched version
CWE-79: Improper Neutralization of Input During Web Page Generation
L’éditeur l’a corrigée dans 2.9.29 ; cette version n’est pas encore dans le dépôt.
Aucune version de ce dépôt n’est concernée.
Détails
The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.9.28.1. This is due to a compound failure involving missing authorization on the `create_from_template` AJAX endpoint (allowing any authenticated user to create forms), insufficient input sanitization (`sanitize_text_field()` preserves single quotes), and missing output escaping when the form title is rendered in the Form Switcher dropdown (`title` attribute constructed without `esc_attr()`, and JavaScript `saferHtml` utility only escapes `&`, `<`, `>` but not quotes). This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary JavaScript that executes when an Administrator searches in the Form Switcher dropdown in the Form Editor.
Correction: Update to version 2.9.29, or a newer patched version
CWE-79: Improper Neutralization of Input During Web Page Generation
L’éditeur l’a corrigée dans 2.9.23.1 ; cette version n’est pas encore dans le dépôt.
Aucune version de ce dépôt n’est concernée.
Détails
The Gravity Forms plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in all versions up to, and including, 2.9.23.0. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Correction: Update to version 2.9.23.1, or a newer patched version
CWE-434: Unrestricted Upload of File with Dangerous Type
L’éditeur l’a corrigée dans 2.9.22 ; cette version n’est pas encore dans le dépôt.
Aucune version de ce dépôt n’est concernée.
Détails
The Gravity Forms plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the legacy chunked upload mechanism in all versions up to, and including, 2.9.21.1. This is due to the extension blacklist not including .phar files, which can be uploaded through the chunked upload mechanism. This makes it possible for unauthenticated attackers to upload executable .phar files and achieve remote code execution on the server, granted they can discover or enumerate the upload path. In order for an attacker to achieve RCE, the web server needs to be set up to process .phar file as PHP via file handler mapping or similar.
Correction: Update to version 2.9.22, or a newer patched version
CWE-434: Unrestricted Upload of File with Dangerous Type
L’éditeur l’a corrigée dans 2.9.21 ; cette version n’est pas encore dans le dépôt.
Aucune version de ce dépôt n’est concernée.
Détails
The Gravity Forms plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the copy_post_image() function in all versions up to, and including, 2.9.20. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. This only impacts sites that have allow_url_fopen set to `On`, the post creation form enabled along with a file upload field for the post
Correction: Update to version 2.9.21, or a newer patched version
CWE-434: Unrestricted Upload of File with Dangerous Type
L’éditeur l’a corrigée dans 2.9.2 ; cette version n’est pas encore dans le dépôt.
Aucune version de ce dépôt n’est concernée.
Détails
The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘alt’ parameter in all versions up to, and including, 2.9.1.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Correction: Update to version 2.9.2, or a newer patched version
CWE-79: Improper Neutralization of Input During Web Page Generation
L’éditeur l’a corrigée dans 2.9.2 ; cette version n’est pas encore dans le dépôt.
Aucune version de ce dépôt n’est concernée.
Détails
The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘style_settings’ parameter in versions 2.9.0.1 up to, and including, 2.9.1.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The attack is only successful in the Chrome web browser, and requires directly browsing the media file via the attachment post.
Correction: Update to version 2.9.2, or a newer patched version
CWE-79: Improper Neutralization of Input During Web Page Generation
L’éditeur l’a corrigée dans 2.7.5 ; cette version n’est pas encore dans le dépôt.
Aucune version de ce dépôt n’est concernée.
Détails
The Gravity Forms plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URLs in versions up to, and including, 2.7.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Correction: Update to version 2.7.5, or a newer patched version
CWE-79: Improper Neutralization of Input During Web Page Generation
L’éditeur l’a corrigée dans 2.7.4 ; cette version n’est pas encore dans le dépôt.
Aucune version de ce dépôt n’est concernée.
Détails
The Gravity Forms plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 2.7.3 via deserialization of untrusted input in the get_field_input function. This allows unauthenticated attackers to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
Correction: Update to version 2.7.4, or a newer patched version
L’éditeur l’a corrigée dans 2.4.9 ; cette version n’est pas encore dans le dépôt.
Aucune version de ce dépôt n’est concernée.
Détails
common.php in the Gravity Forms plugin before 2.4.9 for WordPress can leak hashed passwords because user_pass is not considered a special case for a $current_user->get($property) call.
Correction: Update to version 2.4.9, or a newer patched version
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
L’éditeur l’a corrigée dans 2.0.7 ; cette version n’est pas encore dans le dépôt.
Aucune version de ce dépôt n’est concernée.
Détails
WordPress Plugin Gravity Forms is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. WordPress Plugin Gravity Forms version 2.0.6.5 is vulnerable; prior versions may also be affected.
Correction: Update to version 2.0.7, or a newer patched version
CWE-79: Improper Neutralization of Input During Web Page Generation
L’éditeur l’a corrigée dans 1.9.16 ; cette version n’est pas encore dans le dépôt.
Aucune version de ce dépôt n’est concernée.
Détails
The Gravityforms plugin for WordPress is vulnerable to Reflected Cross-Site Scripting up to, and including, 1.9.15.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Correction: Update to version 1.9.16, or a newer patched version
CWE-79: Improper Neutralization of Input During Web Page Generation
L’éditeur l’a corrigée dans 1.9.7 ; cette version n’est pas encore dans le dépôt.
Aucune version de ce dépôt n’est concernée.
Détails
The Gravityforms plugin for WordPress is vulnerable to Cross-Site Scripting in versions up to, and including, 1.9.6 due to insufficient input sanitization and output escaping alongside the use of add_query_arg or remove_query_arg(). This makes it possible for attackers to inject arbitrary web scripts that execute in a victim's browser.
Correction: Update to version 1.9.7, or a newer patched version
CWE-79: Improper Neutralization of Input During Web Page Generation
L’éditeur l’a corrigée dans 1.9.3.6 ; cette version n’est pas encore dans le dépôt.
Aucune version de ce dépôt n’est concernée.
Détails
The Gravifyforms plugin for WordPress is vulnerable to blind SQL Injection via the ‘sort_column GET’ parameter in versions up to, and including,1.9.3.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Correction: Update to version 1.9.3.6, or a newer patched version
CWE-89: Improper Neutralization of Special Elements used in an SQL Command
L’éditeur l’a corrigée dans 1.8.20 ; cette version n’est pas encore dans le dépôt.
Aucune version de ce dépôt n’est concernée.
Détails
The Gravityforms plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation via the includes/upload.php file in versions up to, and including, 1.8.19. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible
Correction: Update to version 1.8.20, or a newer patched version
CWE-434: Unrestricted Upload of File with Dangerous Type
Données de vulnérabilités : Wordfence Intelligence. Chaque bulletin renvoie à sa fiche sur ce site.
Copyright 2012-2026 Defiant Inc.. Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. https://www.wordfence.com/wordfence-intelligence-terms-and-conditions/
Copyright 1999-2026 The MITRE Corporation. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. https://www.cve.org/Legal/TermsOfUse
