Atomic Edge analysis of CVE-2026-5110 (metadata-based): This vulnerability allows unauthenticated stored cross-site scripting (XSS) in the Gravity Forms plugin for WordPress, affecting versions up to and including 2.10.0. The flaw resides in how the SingleProduct field is handled when nested inside a Repeater field. An attacker can inject arbitrary HTML and JavaScript into the product name field, which gets stored in the database and executes when an administrator views the entry in the WordPress admin area. The CVSS score of 7.2 (high severity) reflects the network-based, low-complexity attack that requires no authentication and impacts confidentiality and integrity at a limited scope.
Root Cause: The description confirms that the issue stems from insufficient input validation and output escaping in the SingleProduct field’s handling within Repeater contexts. The validate_subfield() method calls the field’s validate() method, which only validates the quantity subfield, not the product name. This allows an attacker to tamper with the product name field (input .1) without triggering the failed_state_validation() mechanism. Additionally, sanitize_entry_value() returns raw values when HTML is not expected for the field type, meaning the malicious input is saved unsanitized. Finally, get_value_entry_detail() outputs the product name without escaping. Atomic Edge analysis notes that these conclusions are directly extracted from the CVE description; no source code diff was available for independent verification, but the described pattern is consistent with common Gravity Forms field handling logic and the CWE-79 classification.
Exploitation: An unauthenticated attacker can exploit this by submitting a Gravity Forms entry that includes a Repeater field containing a SingleProduct field. The attacker crafts the product name subfield (likely a form input named something like input_1.1 or similar) with a malicious payload, such as alert(document.cookie). The form submission is sent to the standard WordPress endpoint for Gravity Forms (typically via AJAX or direct POST to /wp-admin/admin-ajax.php with action=gf_submit or similar). Because the validation flow fails to sanitize the product name, the payload is stored in the database. When an administrator later views the entry in the WordPress admin area (wp-admin/admin.php?page=gf_entries), the payload executes in the admin’s browser. The attack requires no authentication, making it accessible to any visitor.
Remediation: The patched version (2.10.1) likely addresses this by adding proper input validation and output escaping for the SingleProduct field’s product name, especially when nested within Repeater fields. Specifically, the fix probably involves (1) implementing validation for the product name subfield in the SingleProduct field’s validate() method to reject or sanitize HTML, (2) updating sanitize_entry_value() to escape output when HTML is not expected, and (3) adding escaping in get_value_entry_detail() for the product name. Atomic Edge analysis recommends that administrators update to version 2.10.1 immediately. As a virtual patch, blocking form submissions containing script tags in the product name subfield can mitigate the risk.
Impact: Successful exploitation allows an unauthenticated attacker to inject arbitrary JavaScript into the admin interface. This can lead to theft of admin session cookies, redirection to malicious sites, defacement, or execution of actions under the admin’s context (e.g., creating new admin users, modifying site content). The CVSS scope change (C) indicates the attack affects resources beyond the original vulnerable component, such as the broader WordPress admin session. While the CIA impacts are limited (L:L), the combination of unauthenticated access and stored XSS in the admin panel poses a significant security risk to WordPress sites using the vulnerable plugin.
