CVE-2026-4406
The Gravity Forms plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the parameter in the AJAX action in all versions up to, and including, 2.9.30.
Published Apr 8, 2026 · updated Jul 24, 2026
The Gravity Forms plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the parameter in the AJAX action in all versions up to, and including, 2.9.30. This is due to the method outputting JSON-encoded data wrapped in HTML comment delimiters using and , which serves the response with a header instead of . The function does not HTML-encode angle brackets within JSON string values, allowing injected HTML/script tags in array values to be parsed and executed by the browser. The required is generated with and is publicly embedded on every page that renders a Gravity Forms form, making it identical for all unauthenticated visitors within the same 12-hour nonce tick. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This vulnerability cannot be exploited against users who are authenticated on the target system, but could be used to alter the target page.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Apr 8, 2026 · NIST NVD
Detected
The Gravity Forms plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the parameter in the AJAX action in all versions up to, and including, 2.9.30. This is due to the method outputting JSON-encoded data wrapped in HTML comment delimiters using and , which serves the response with a header instead of . The function does not HTML-encode angle brackets within JSON string values,
Jul 24, 2026 · NIST NVD
Updated
The Gravity Forms plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the parameter in the AJAX action in all versions up to, and including, 2.9.30. This is due to the method outputting JSON-encoded data wrapped in HTML comment delimiters using and , which serves the response with a header instead of . The function does not HTML-encode angle brackets within JSON string values,
Sources
- CVE.orgVulnerability recordCVE-2026-4406
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-4406
The Gravity Forms plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the parameter in the AJAX action in all versions up to, and including, 2.9.30. This is due to the method outputting JSON-encoded data w
nvd.nist.gov