Gravity Forms < 2.7.5 - Reflected XSS

Vulnerability

The Gravity Forms WordPress plugin versions before 2.7.5 fail to escape generated URLs before outputting them in HTML attributes, leading to a reflected cross-site scripting (XSS) vulnerability. This affects all versions prior to 2.7.5. [1]

Exploitation

An attacker can craft a malicious URL that, when visited by a high-privileged user (e.g., admin), injects arbitrary JavaScript into the page. The attack requires no authentication from the attacker but relies on the victim clicking the crafted link. A proof of concept is available from the researcher. [1]

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the context of the victim's session. This can lead to theft of cookies, session tokens, or performing actions on behalf of the admin, potentially compromising the entire WordPress site.

Mitigation

The vulnerability is fixed in version 2.7.5 of the Gravity Forms plugin. Users should update to 2.7.5 or later immediately. No workarounds are mentioned. The plugin is not listed on CISA's KEV as of the publication date. [1]