CVE-2026-4394

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-4394", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-03-18T15:38:35.787Z", "datePublished": "2026-04-07T23:25:28.066Z", "dateUpdated": "2026-04-08T16:59:52.157Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:59:52.157Z"}, "affected": [{"vendor": "Gravity Forms", "product": "Gravity Forms", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.9.30", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Credit Card field's 'Card Type' sub-field (`input_<id>.4`) in all versions up to, and including, 2.9.30. This is due to the `get_value_entry_detail()` method in the `GF_Field_CreditCard` class outputting the card type value without escaping, combined with `get_value_save_entry()` accepting and storing unsanitized user input for the `input_<id>.4` parameter. The Card Type field is not rendered on the frontend form (it is normally derived from the card number), but the backend submission parser blindly accepts it if included in the POST request. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute when an administrator views the form entry in the WordPress dashboard."}], "title": "Gravity Forms <= 2.9.30 - Unauthenticated Stored Cross-Site Scripting via Credit Card 'Card Type' Sub-Field", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6f38d7b7-6df6-47a2-a9ba-87ef1f039e44?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/gravityforms/trunk/includes/fields/class-gf-field-creditcard.php#L516"}, {"url": "https://plugins.trac.wordpress.org/browser/gravityforms/tags/2.9.25/includes/fields/class-gf-field-creditcard.php#L516"}, {"url": "https://plugins.trac.wordpress.org/browser/gravityforms/trunk/includes/fields/class-gf-field-creditcard.php#L577"}, {"url": "https://plugins.trac.wordpress.org/browser/gravityforms/tags/2.9.25/includes/fields/class-gf-field-creditcard.php#L577"}, {"url": "https://docs.gravityforms.com/gravityforms-change-log/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "baseScore": 6.1, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "tadokun"}], "timeline": [{"time": "2026-03-18T15:53:51.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-04-07T10:47:07.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-08T14:47:27.701858Z", "id": "CVE-2026-4394", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-08T16:14:27.635Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-4394", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-08T14:47:27.701858Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-08T14:47:28.695Z"}}], "cna": {"title": "Gravity Forms <= 2.9.30 - Unauthenticated Stored Cross-Site Scripting via Credit Card 'Card Type' Sub-Field", "credits": [{"lang": "en", "type": "finder", "value": "tadokun"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "Gravity Forms", "product": "Gravity Forms", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.9.30"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-03-18T15:53:51.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-04-07T10:47:07.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6f38d7b7-6df6-47a2-a9ba-87ef1f039e44?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/gravityforms/trunk/includes/fields/class-gf-field-creditcard.php#L516"}, {"url": "https://plugins.trac.wordpress.org/browser/gravityforms/tags/2.9.25/includes/fields/class-gf-field-creditcard.php#L516"}, {"url": "https://plugins.trac.wordpress.org/browser/gravityforms/trunk/includes/fields/class-gf-field-creditcard.php#L577"}, {"url": "https://plugins.trac.wordpress.org/browser/gravityforms/tags/2.9.25/includes/fields/class-gf-field-creditcard.php#L577"}, {"url": "https://docs.gravityforms.com/gravityforms-change-log/"}], "descriptions": [{"lang": "en", "value": "The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Credit Card field's 'Card Type' sub-field (`input_<id>.4`) in all versions up to, and including, 2.9.30. This is due to the `get_value_entry_detail()` method in the `GF_Field_CreditCard` class outputting the card type value without escaping, combined with `get_value_save_entry()` accepting and storing unsanitized user input for the `input_<id>.4` parameter. The Card Type field is not rendered on the frontend form (it is normally derived from the card number), but the backend submission parser blindly accepts it if included in the POST request. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute when an administrator views the form entry in the WordPress dashboard."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:59:52.157Z"}}}, "cveMetadata": {"cveId": "CVE-2026-4394", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:59:52.157Z", "dateReserved": "2026-03-18T15:38:35.787Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-04-07T23:25:28.066Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Gravity Forms", "vendor": "Gravity Forms", "versions": [{"lessThanOrEqual": "2.9.30", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Credit Card field's 'Card Type' sub-field (`input_<id>.4`) in all versions up to, and including, 2.9.30. This is due to the `get_value_entry_detail()` method in the `GF_Field_CreditCard` class outputting the card type value without escaping, combined with `get_value_save_entry()` accepting and storing unsanitized user input for the `input_<id>.4` parameter. The Card Type field is not rendered on the frontend form (it is normally derived from the card number), but the backend submission parser blindly accepts it if included in the POST request. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute when an administrator views the form entry in the WordPress dashboard."}, {"lang": "es", "value": "El plugin Gravity Forms para WordPress es vulnerable a cross-site scripting almacenado a trav\u00e9s del subcampo Tipo de Tarjeta del campo Tarjeta de Cr\u00e9dito ('input_ id .4') en todas las versiones hasta la 2.9.30, inclusive. Esto se debe a que el m\u00e9todo 'get_value_entry_detail()' en la clase 'GF_Field_CreditCard' emite el valor del tipo de tarjeta sin escapar, combinado con que 'get_value_save_entry()' acepta y almacena entrada de usuario no saneada para el par\u00e1metro 'input_ id .4'. El campo Tipo de Tarjeta no se renderiza en el formulario de frontend (normalmente se deriva del n\u00famero de tarjeta), pero el analizador de env\u00edo de backend lo acepta ciegamente si se incluye en la solicitud POST. Esto hace posible que atacantes no autenticados inyecten scripts web arbitrarios que se ejecutan cuando un administrador ve la entrada del formulario en el panel de WordPress."}], "id": "CVE-2026-4394", "lastModified": "2026-07-24T23:10:00.563", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-4394", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-08T14:47:27.701858Z", "version": "2.0.3"}}]}, "published": "2026-04-08T00:16:05.147", "references": [{"source": "security@wordfence.com", "url": "https://docs.gravityforms.com/gravityforms-change-log/"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/gravityforms/tags/2.9.25/includes/fields/class-gf-field-creditcard.php#L516"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/gravityforms/tags/2.9.25/includes/fields/class-gf-field-creditcard.php#L577"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/gravityforms/trunk/includes/fields/class-gf-field-creditcard.php#L516"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/gravityforms/trunk/includes/fields/class-gf-field-creditcard.php#L577"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6f38d7b7-6df6-47a2-a9ba-87ef1f039e44?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.9.30]"}}], "enrichment": {"confidence": 98.0, "confidence_source": "matching", "scores": [{"score": 98.0, "source": "matching"}]}, "original": {"product": "Gravity Forms", "source": "cna", "vendor": "Gravity Forms"}, "product": "gravity_forms", "vendor": "gravityforms"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-08T00:20:40.170797+00:00", "value": {"mitigation_remediation": ["Upgrade Gravity Forms to version 2.9.31 or later.", "Verify that forms do not submit or store the \"Card Type\" sub-field; if necessary, disable or remove credit\u2011card fields from forms until a patch is applied.", "Implement a Content Security Policy that restricts inline scripts to mitigate potential XSS until a patch is in place.", "Monitor the WordPress Admin dashboard for unexpected script execution and review entry logs for suspicious changes."], "summary": {"action": "Patch Now", "impact": "Stored Cross\u2011Site Scripting (XSS)"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the Gravity Forms plugin for WordPress in all releases up to and including version 2.9.30. Any WordPress site that has that plugin version installed and uses a credit\u2011card field in a form is potentially impacted.", "description_and_impact": "Gravity Forms, a WordPress plugin, contains a stored cross\u2011site scripting vulnerability that allows unauthenticated users to inject arbitrary JavaScript into the credit card \"Card Type\" sub\u2011field. The unsanitized value is stored in the database and rendered unescaped when an administrator views a form entry, enabling the attacker to execute malicious scripts with the administrator\u2019s permissions. The flaw is a classic input validation issue (CWE\u201179) that can lead to data theft, session hijacking, or defacement of the backend interface.", "risk_and_exploitability": "The CVSS score of 6.1 indicates medium severity, and the vulnerability can be exploited by sending a crafted POST request containing a malicious value for input_<id>.4 to any form that uses the credit\u2011card field. The attacker does not need authentication or privileged access, making it a broad threat to sites that implement the affected plugin version. Although this flaw is not listed in the CISA KEV catalog and no EPSS score is available, the possibility of automated exploitation exists, especially if the site exposes a public form entry interface."}}}}, "created": "2026-04-08T19:33:46.676005+00:00", "updated": "2026-04-08T19:45:05.854128+00:00", "vendors": ["gravityforms", "gravityforms$PRODUCT$gravity_forms", "wordpress", "wordpress$PRODUCT$wordpress"]}