Gravity Forms Nested Field Stored XSS Vulnerability

The Gravity Forms plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting in versions up to and including 2.10.0. This is due to insufficient input validation and output escaping in the SingleProduct field when used inside a Repeater field. When SingleProduct fields are nested within Repeater fields, the validation flow bypasses the state validation mechanism (failed_state_validation()) that would normally prevent tampering with field values. The validate_subfield() method only calls the field's validate() method, which for SingleProduct fields only validates the quantity field and does not check the product name field for tampering. As a result, an attacker can inject arbitrary HTML and JavaScript into the product name field (input .1). This malicious input is then saved to the database without sanitization because sanitize_entry_value() returns raw values when HTML is not expected for the field type. When an administrator views the entry in wp-admin/admin.ph

Casky was already ahead

This CVE exploits attack patterns that Casky's 301matched skills have been training on — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Gravity Forms plugin for WordPress contains a critical stored cross-site scripting (XSS) vulnerability in versions up to 2.10.0 that allows unauthenticated attackers to inject malicious scripts into web pages viewed by other users. The vulnerability exists in SingleProduct fields when nested within Repeater fields, where insufficient input validation and output escaping create an attack vector. This is particularly dangerous because the nesting structure causes the plugin to bypass its normal state validation mechanism (failed_state_validation()), allowing attackers to tamper with field values that would normally be rejected. WordPress sites using Gravity Forms are directly affected, with potential impact spanning any website relying on this widely-deployed form builder plugin for user interactions, data collection, or e-commerce functionality.

Casky's 301 mapped skills leverage Claude's extended reasoning to detect the attack patterns behind this vulnerability across the MITRE ATT&CK framework. Detection focuses on TA0001 (Initial Access) where attackers exploit the input validation bypass to establish a foothold, and TA0043 (Reconnaissance) techniques used to identify vulnerable Gravity Forms installations. Practitioners using Casky would observe findings related to malicious script injection patterns in form submissions, abnormal field validation workflows that skip expected security checks, and DOM-based anomalies indicating stored XSS payloads. The platform's skill set identifies suspicious nested Repeater field structures, tracks input sanitization gaps in form processing, and flags instances where user-controlled data reaches output contexts without proper escaping—enabling security teams to locate vulnerable form configurations before exploitation occurs.

301 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-5110.

analyzing-apt-group-with-mitre-navigator

threat intelligence · low

Run

analyzing-campaign-attribution-evidence

threat intelligence · low

Run

analyzing-certificate-transparency-for-phishing

threat intelligence · low

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Practise detecting this in the Casky Playground

Run Claude AI skills against real targets and see findings like those behind CVE-2026-5110 — before the next CVE drops.

Join the Playground Waitlist →

X Instagram LinkedIn