Gravity Forms

Every one of the 19 is a mark on the map. Named now: 1 to 19, most at risk first.

1. WordPress Gravity Forms Plugin <=3.1.0.4 - Unauthenticated Arbitrary File UploadCVE-2026-84434Gravity Forms · CVSS 9.8 · 3.9% likely

   CWE-434

2. Gravity Forms <= 2.9.20 - Unauthenticated Arbitrary File Upload via 'copy_post_image'CVE-2025-12352Gravity Forms · CVSS 9.8 · 1.1% likely

   CWE-434

3. Gravity Forms <= 2.10.4 - Unauthenticated Arbitrary File Read via 'gform_uploaded_files' ParameterCVE-2026-12997Gravity Forms · CVSS 7.5 · 0.9% likely

   CWE-22

4. Gravity Forms <= 2.9.21.1 - Unauthenticated Arbitrary File Upload via Legacy Chunked UploadCVE-2025-12974Gravity Forms · CVSS 8.1 · 0.7% likely

   CWE-434

5. Gravity Forms <= 3.0.2 - Unauthenticated Arbitrary File Upload via State/Chunk Hash ConfusionCVE-2026-19513Gravity Forms · CVSS 8.1 · 0.7% likely

   CWE-434

6. Gravity Forms <= 3.1.2 - Unauthenticated PHP Object Injection via Post Custom FieldCVE-2026-103039Gravity Forms · CVSS 9.8 · 0.5% likely

   CWE-502

7. Gravity Forms <= 2.9.30 - Reflected Cross-Site Scripting via 'form_ids' ParameterCVE-2026-4406Gravity Forms · CVSS 4.7 · 0.4% likely

   CWE-79

8. GravityForms <= 2.9.1.3 - Unauthenticated Stored Cross-Site Scripting via 'alt' parameterCVE-2024-13377Gravity Forms · CVSS 7.2 · 0.3% likely

   CWE-79

9. Gravity Forms <= 2.10.5 - Unauthenticated Stored Cross-Site Scripting via Post Body Field ValueCVE-2026-16649Gravity Forms · CVSS 7.2 · 0.3% likely

   CWE-79

10. Gravity Forms <= 2.9.30 - Unauthenticated Stored Cross-Site Scripting via Credit Card 'Card Type' Sub-FieldCVE-2026-4394Gravity Forms · CVSS 6.1 · 0.3% likely

    CWE-79

11. GravityForms 2.9.0.1 - 2.9.1.3 - Unauthenticated Stored Cross-Site Scripting via 'style_settings' parameterCVE-2024-13378Gravity Forms · CVSS 5.4 · 0.3% likely

    CWE-79

12. Gravity Forms <= 2.10.0 - Unauthenticated Stored Cross-Site Scripting via Hidden Product Field in RepeaterCVE-2026-5111Gravity Forms · CVSS 7.2 · 0.3% likely

    CWE-79

13. Gravity Forms <= 2.10.0 - Unauthenticated Stored Cross-Site Scripting via Single Product Field Inside RepeaterCVE-2026-5110Gravity Forms · CVSS 7.2 · 0.2% likely

    CWE-79

14. Gravity Forms <= 2.10.0 - Unauthenticated Stored Cross-Site Scripting via Product OptionCVE-2026-5109Gravity Forms · CVSS 7.2 · 0.2% likely

    CWE-79

15. Gravity Forms <= 2.10.0 - Unauthenticated Stored Cross-Site Scripting via Consent Field Hidden InputCVE-2026-5113Gravity Forms · CVSS 7.2 · 0.2% likely

    CWE-79

16. Gravity Forms <= 2.9.28.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Form TitleCVE-2026-3492Gravity Forms · CVSS 6.4 · 0.2% likely

    CWE-79

17. Gravity Forms <= 2.10.0 - Unauthenticated Stored Cross-Site Scripting via Calculation Product Field in RepeaterCVE-2026-5112Gravity Forms · CVSS 7.2 · 0.2% likely

    CWE-79

18. Gravity Forms <= 3.1.2 - Unauthenticated Stored Cross-Site Scripting via List FieldCVE-2026-97645Gravity Forms · CVSS 7.2 · 0.2% likely

    CWE-79

19. Gravity Forms <= 3.1.1 - Unauthenticated Stored Cross-Site Scripting via Post Excerpt / Post Custom Field / Rich-Text Paragraph Field ValuesCVE-2026-90437Gravity Forms · CVSS 7.2 · 0.2% likely

    CWE-79

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.