Gravity Forms Hidden Product Field Stored XSS Vulnerability

The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 2.10.0. This is due to insufficient input validation and output escaping on Hidden Product field values when used inside Repeater fields, where repeater subfields bypass state validation checks and the Hidden Product validate() method only validates the quantity field while ignoring the product name field that is later output without proper escaping in the get_value_entry_detail() method. This makes it possible for unauthenticated attackers to inject arbitrary web scripts through form submissions that will execute whenever an administrator views the entry details.

Casky was already ahead

This CVE exploits attack patterns that Casky's 301matched skills have been training on — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Gravity Forms plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in versions up to 2.10.0 that affects Hidden Product fields when used within Repeater fields. The vulnerability exists because the plugin fails to properly validate and escape the product name field—while the validate() method checks the quantity field, it completely bypasses validation for the product name, which is later rendered without proper output escaping in the get_value_entry_detail() function. This allows authenticated attackers with form submission capabilities to inject malicious JavaScript that persists in the database and executes for any user viewing the form entries, potentially leading to session hijacking, credential theft, or malware distribution. Organizations using Gravity Forms for e-commerce, lead generation, or data collection are affected, particularly those with user-facing forms that allow product customization.

Casky's 301 mapped security skills leverage Claude AI's extended reasoning to detect the attack patterns associated with MITRE techniques TA0001 (Initial Access) and TA0043 (Reconnaissance). Practitioners using Casky would identify this vulnerability through pattern detection across input validation bypass indicators and output encoding gaps—specifically flagging instances where form field data flows from user input through repeater subfields without state validation checks, then surfaces in database queries and HTML output without escaping. The platform's skill mapping would highlight the CWE-79 (Improper Neutralization of Input During Web Page Generation) pattern, correlating inadequate sanitization in the validate() method with unsafe rendering in get_value_entry_detail(). Security teams would see findings detailing the attack chain: malicious payload injection → database storage → unescaped output rendering → client-side execution, enabling them to prioritize patching and implement input validation controls before exploitation occurs.

301 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-5111.

analyzing-apt-group-with-mitre-navigator

threat intelligence · low

Run

analyzing-campaign-attribution-evidence

threat intelligence · low

Run

analyzing-certificate-transparency-for-phishing

threat intelligence · low

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Practise detecting this in the Casky Playground

Run Claude AI skills against real targets and see findings like those behind CVE-2026-5111 — before the next CVE drops.

Join the Playground Waitlist →

X Instagram LinkedIn