Cross-site Scripting

Every one of the 13 is a mark on the map. Named now: 1 to 13, most at risk first.

1. Gravity Forms <= 2.9.30 - Reflected Cross-Site Scripting via 'form_ids' ParameterCVE-2026-4406Gravity Forms · CVSS 4.7 · 0.4% likely

   CWE-79

2. GravityForms <= 2.9.1.3 - Unauthenticated Stored Cross-Site Scripting via 'alt' parameterCVE-2024-13377Gravity Forms · CVSS 7.2 · 0.3% likely

   CWE-79

3. Gravity Forms <= 2.10.5 - Unauthenticated Stored Cross-Site Scripting via Post Body Field ValueCVE-2026-16649Gravity Forms · CVSS 7.2 · 0.3% likely

   CWE-79

4. Gravity Forms <= 2.9.30 - Unauthenticated Stored Cross-Site Scripting via Credit Card 'Card Type' Sub-FieldCVE-2026-4394Gravity Forms · CVSS 6.1 · 0.3% likely

   CWE-79

5. GravityForms 2.9.0.1 - 2.9.1.3 - Unauthenticated Stored Cross-Site Scripting via 'style_settings' parameterCVE-2024-13378Gravity Forms · CVSS 5.4 · 0.3% likely

   CWE-79

6. Gravity Forms <= 2.10.0 - Unauthenticated Stored Cross-Site Scripting via Hidden Product Field in RepeaterCVE-2026-5111Gravity Forms · CVSS 7.2 · 0.3% likely

   CWE-79

7. Gravity Forms <= 2.10.0 - Unauthenticated Stored Cross-Site Scripting via Single Product Field Inside RepeaterCVE-2026-5110Gravity Forms · CVSS 7.2 · 0.2% likely

   CWE-79

8. Gravity Forms <= 2.10.0 - Unauthenticated Stored Cross-Site Scripting via Product OptionCVE-2026-5109Gravity Forms · CVSS 7.2 · 0.2% likely

   CWE-79

9. Gravity Forms <= 2.10.0 - Unauthenticated Stored Cross-Site Scripting via Consent Field Hidden InputCVE-2026-5113Gravity Forms · CVSS 7.2 · 0.2% likely

   CWE-79

10. Gravity Forms <= 2.9.28.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Form TitleCVE-2026-3492Gravity Forms · CVSS 6.4 · 0.2% likely

    CWE-79

11. Gravity Forms <= 2.10.0 - Unauthenticated Stored Cross-Site Scripting via Calculation Product Field in RepeaterCVE-2026-5112Gravity Forms · CVSS 7.2 · 0.2% likely

    CWE-79

12. Gravity Forms <= 3.1.2 - Unauthenticated Stored Cross-Site Scripting via List FieldCVE-2026-97645Gravity Forms · CVSS 7.2 · 0.2% likely

    CWE-79

13. Gravity Forms <= 3.1.1 - Unauthenticated Stored Cross-Site Scripting via Post Excerpt / Post Custom Field / Rich-Text Paragraph Field ValuesCVE-2026-90437Gravity Forms · CVSS 7.2 · 0.2% likely

    CWE-79

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.