CVE-2026-4394

The Gravity Forms plugin for WordPress versions up to 2.9.30 contains a stored cross-site scripting vulnerability in the Credit Card field's Card Type sub-field (input_.4). The get_value_entry_detail() method outputs the card type value without escaping, while get_value_save_entry() accepts and stores unsanitized user input for this parameter [1]. Although the Card Type field is not displayed on the frontend form (it is normally derived from the card number), the backend submission parser blindly processes it if included in the POST request.

An unauthenticated attacker can exploit this vulnerability by submitting a form with a crafted POST parameter containing malicious JavaScript in the card type value. Since the field is not rendered on the frontend, the attacker simply sends a direct POST request with the malicious input. When an administrator later views the entry in the WordPress dashboard, the injected script executes in the context of the admin's session.

This stored XSS can lead to various malicious actions, such as stealing administrative cookies, performing actions as the admin, or redirecting to malicious sites. The impact is limited to the administrative interface but poses a significant risk due to elevated privileges.

The vendor has addressed this vulnerability in subsequent releases, as indicated by security enhancements in version 2.10.2 and earlier (see [1]). Users are strongly advised to update to the latest version of Gravity Forms to mitigate this and other potential vulnerabilities.