PatchSiren cyber security CVE debrief
CVE-2026-4406 Gravity Forms CVE debrief
The Gravity Forms plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `form_ids` parameter in the `gform_get_config` AJAX action in all versions up to, and including, 2.9.30. This vulnerability allows unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The required `config_nonce` is generated with `wp_create_nonce('gform_config_ajax')` and is publicly embedded on every page that renders a Gravity Forms form, making it identical for all unauthenticated visitors within the same 12-hour nonce tick.
- Vendor
- Gravity Forms
- Product
- Unknown
- CVSS
- MEDIUM 4.7
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-04-08
- Original CVE updated
- 2026-07-24
- Advisory published
- 2026-04-08
- Advisory updated
- 2026-07-24
Who should care
Users of Gravity Forms plugin for WordPress should be aware of this Reflected Cross-Site Scripting vulnerability. Successful exploitation requires tricking a user into performing an action such as clicking on a link. Users should verify their versions and configurations.
Technical summary
The `GFCommon::send_json()` method outputs JSON-encoded data wrapped in HTML comment delimiters using `echo` and `wp_die()`, serving the response with a `Content-Type: text/html` header instead of `application/json`. The `wp_json_encode()` function does not HTML-encode angle brackets within JSON string values, allowing injected HTML/script tags in `form_ids` array values to be parsed and executed by the browser. Successful exploitation requires tricking a user into performing an action such as clicking on a link.
Defensive priority
Medium priority due to CVSS score of 4.7 and potential for user interaction required for exploitation.
Recommended defensive actions
- Apply patches or upgrade to a fixed version when available
- Implement Content Security Policy (CSP) to restrict script execution
- Monitor for suspicious activity and anomalies
- Use a Web Application Firewall (WAF) to filter malicious traffic
- Educate users about safe browsing practices
- Review compensating controls for exposed systems while remediation is scheduled and verified
- Track exceptions, retest remediated assets, and close the item only after evidence is documented
Evidence notes
The CVE record was published on 2026-04-08T00:16:05.490Z and was last modified on 2026-07-24T23:10:00.563Z. The NVD entry is currently Deferred. The Gravity Forms plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `form_ids` parameter in the `gform_get_config` AJAX action in all versions up to, and including, 2.9.30. This vulnerability cannot be exploited against users who are authenticated on the target system, but could be used to alter the target page. Users should verify their versions and configurations.
Official resources
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-04-08T00:16:05.490Z and has not been modified since then. The NVD entry is currently Deferred.