Gravity Forms Stored XSS via Unsanitized Product Options

The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 2.10.0. This is due to insufficient validation and output escaping of Product Option field values. The vulnerability exists because the state validation function accepts submitted values where the wp_kses()-sanitized version matches a legitimate option value, but then stores the raw unsanitized value in the database. When administrators view entry details via the Order Summary section, the option_label is output directly without escaping (view-order-summary.php line 32), executing the injected JavaScript. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in entry data that will execute whenever an administrator accesses the entry details page.

Casky was already ahead

This CVE exploits attack patterns that Casky's 301matched skills have been training on — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

Gravity Forms, a widely-used WordPress form builder plugin, contains a stored cross-site scripting (XSS) vulnerability affecting versions up to 2.10.0. The vulnerability stems from a logic flaw in the state validation function: while the plugin sanitizes user input using wp_kses() for validation purposes, it stores the original unsanitized value directly in the database. When administrators later view entry details in the Order Summary section, the malicious payload executes in their browser context. This affects WordPress sites relying on Gravity Forms for critical functionality like e-commerce, lead generation, and data collection. Attackers with the ability to submit forms can inject arbitrary JavaScript that will execute whenever an administrator reviews the compromised entry, potentially leading to credential theft, admin account compromise, or further site exploitation.

Casky's 301 mapped skills leverage Claude's extended reasoning to detect the attack patterns underlying this vulnerability across MITRE ATT&CK's Initial Access (TA0001) and Execution (TA0043) tactics. Practitioners using Casky will identify stored XSS indicators by analyzing form submission workflows, database storage patterns, and output rendering in the WordPress admin interface. The platform detects the characteristic signature: user-controlled input that bypasses sanitization checks during storage while lacking proper output encoding during retrieval. Skills will flag unsafe database queries, missing escaping functions (wp_esc_html, wp_esc_attr), and form field values rendered directly in admin pages. By correlating these technical patterns with form submission logs and entry modification timestamps, Casky helps security teams distinguish legitimate form data from injected payloads, enabling rapid identification of compromised entries before administrator interaction triggers code execution.

301 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-5109.

analyzing-apt-group-with-mitre-navigator

threat intelligence · low

Run

analyzing-campaign-attribution-evidence

threat intelligence · low

Run

analyzing-certificate-transparency-for-phishing

threat intelligence · low

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Practise detecting this in the Casky Playground

Run Claude AI skills against real targets and see findings like those behind CVE-2026-5109 — before the next CVE drops.

Join the Playground Waitlist →

X Instagram LinkedIn