Gravity Forms

Gravity Forms through 2.10.5 allows an unauthenticated form submitter to place a payload in a Post Body field that survives wp_kses_post(). Client-side tooltip code browser-decodes the aria-label value, reparses it as innerHTML, and removes script elements without removing event-handler attributes, allowing stored JavaScript execution when the affected content is viewed.

Gravity Forms through 3.0.2 insufficiently validates multi-file upload chunk state in GFAsyncUpload::upload(). On a public form with Multiple Files enabled, an unauthenticated attacker can reuse a public form-state URL hash as a continuation hash and supply a temporary filename, placing a valid PNG or PDF polyglot at an attacker-selected public .php or .html name in the temporary upload directory. This can lead to remote code execution on NGINX or other servers that do not honor the directory's .htaccess protection; where PHP execution is blocked, attacker-written HTML can produce same-origin stored cross-site scripting when its URL is visited.

Gravity Forms is affected by filesystem traversal. The vulnerable path is reachable without authentication. A crafted path can escape the intended directory and reach files or directories elsewhere on the server. The published affected range is <= 2.10.4.

Gravity Forms is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is <= 2.10.0.

Gravity Forms is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is <= 2.10.0.

Gravity Forms is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is <= 2.10.0.

Gravity Forms is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is <= 2.10.0.

Gravity Forms is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is <= 2.10.0.

Gravity Forms is affected by cross-site scripting. Exploitation requires an authenticated subscriber account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Gravity Forms is affected by code execution. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can run attacker-controlled code in the WordPress hosting account.

Gravity Forms is affected by dangerous file upload. The vulnerable path is reachable without authentication. Successful exploitation can place attacker-controlled executable content on the server and may lead to full site compromise.

Gravity Forms is affected by dangerous file upload. The vulnerable path is reachable without authentication. Successful exploitation can place attacker-controlled executable content on the server and may lead to full site compromise.

Gravity Forms is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Gravity Forms is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Gravity Forms is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.