Gravity Forms Unauthenticated Stored XSS in Calculation Fields

The Gravity Forms plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting in versions up to and including 2.10.0. This is due to insufficient input validation and output escaping of Calculation Product field product names when rendered inside Repeater fields. The validate() method in the GF_Field_Calculation class only validates the quantity field (.3) and completely ignores the product name field (.1), allowing malicious HTML to pass through validation. When the value is saved, the sanitize_entry_value() method returns the raw value without sanitization for fields where HTML is not expected. Subsequently, when an entry is viewed in wp-admin, the get_value_entry_detail() method concatenates the unescaped product name directly into the output string, which is then rendered by the repeater's get_value_entry_detail() method without further escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts via form submissions that will

Casky was already ahead

This CVE exploits attack patterns that Casky's 301matched skills have been training on — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-5112 represents a critical vulnerability in the widely-used Gravity Forms WordPress plugin affecting versions up to 2.10.0. The flaw exists in the Calculation Product field's product name handling within Repeater fields, where insufficient input validation and output escaping allows unauthenticated attackers to inject malicious HTML and JavaScript. Because the validate() method in GF_Field_Calculation only validates the quantity field (.3) while completely ignoring the product name field (.1), malicious payloads bypass security controls entirely. This vulnerability affects any WordPress site using Gravity Forms for data collection, product ordering, or interactive forms—potentially impacting thousands of organizations. With a CVSS score of 7.2 (high) and active exploitation likely despite CISA KEV status, this represents an immediate risk for stored XSS attacks that compromise user sessions, steal credentials, and enable site takeover.

Casky's 301 mapped security skills leverage Claude's extended reasoning to detect the attack patterns behind this vulnerability across MITRE ATT&CK techniques TA0001 (Initial Access) and TA0043 (Reconnaissance). Practitioners using Casky would identify suspicious patterns including: unauthenticated form submissions containing HTML/JavaScript entities in product name parameters, stored payloads persisting in form entries and database records, and script execution triggered when forms are rendered to legitimate users. The platform's skills would flag CWE-79 violations—specifically missing output encoding in repeater field rendering—and correlate indicators such as form field values containing script tags, event handlers (onclick, onerror), or encoded payloads that pass validation but execute client-side. By analyzing form submission logs, database queries, and page rendering behavior, practitioners gain visibility into both exploitation attempts and successful compromise, enabling rapid containment and patching decisions.

301 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-5112.

analyzing-apt-group-with-mitre-navigator

threat intelligence · low

Run

analyzing-campaign-attribution-evidence

threat intelligence · low

Run

analyzing-certificate-transparency-for-phishing

threat intelligence · low

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Practise detecting this in the Casky Playground

Run Claude AI skills against real targets and see findings like those behind CVE-2026-5112 — before the next CVE drops.

Join the Playground Waitlist →

X Instagram LinkedIn