CVEs we hold for Gravity

Records whose assigning authority named Gravity as the affected vendor. Newest identifiers first, capped at 200.

CVE-2026-84434Gravity Forms <= 3.1.0.4 - Unauthenticated Arbitrary File Upload via Hidden File Upload FieldGravity Forms

CVE-2026-57665WordPress GravityView plugin <= 3.0.0 - Insecure Direct Object References (IDOR) vulnerabilityGravityKit GravityView

CVE-2026-5113Gravity Forms <= 2.10.0 - Unauthenticated Stored Cross-Site Scripting via Consent Field Hidden InputGravity Forms

CVE-2026-5112Gravity Forms <= 2.10.0 - Unauthenticated Stored Cross-Site Scripting via Calculation Product Field in RepeaterGravity Forms

CVE-2026-5111Gravity Forms <= 2.10.0 - Unauthenticated Stored Cross-Site Scripting via Hidden Product Field in RepeaterGravity Forms

CVE-2026-5110Gravity Forms <= 2.10.0 - Unauthenticated Stored Cross-Site Scripting via Single Product Field Inside RepeaterGravity Forms

CVE-2026-5109Gravity Forms <= 2.10.0 - Unauthenticated Stored Cross-Site Scripting via Product OptionGravity Forms

CVE-2026-4406Gravity Forms <= 2.9.30 - Reflected Cross-Site Scripting via 'form_ids' ParameterGravity Forms

CVE-2026-4394Gravity Forms <= 2.9.30 - Unauthenticated Stored Cross-Site Scripting via Credit Card 'Card Type' Sub-FieldGravity Forms

CVE-2026-3492Gravity Forms <= 2.9.28.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Form TitleGravity Forms

CVE-2026-2508Gravity Forms Booking <= 2.7.1 - Authenticated (Subscriber+) Time-Based SQL Injection via 'staff_id'GravityMore Gravity Bookings

CVE-2026-19513Gravity Forms <= 3.0.2 - Unauthenticated Arbitrary File Upload via State/Chunk Hash ConfusionGravity Forms

CVE-2026-1719Gravity Bookings <= 2.5.9 - Unauthenticated SQL Injection via 'category_id' ParameterGravityMore Gravity Bookings

CVE-2026-16649Gravity Forms <= 2.10.5 - Unauthenticated Stored Cross-Site Scripting via Post Body Field ValueGravity Forms

CVE-2026-12997Gravity Forms <= 2.10.4 - Unauthenticated Arbitrary File Read via 'gform_uploaded_files' ParameterGravity Forms

CVE-2025-49271WordPress GravityWP - Merge Tags <= 1.4.4 - Local File Inclusion VulnerabilityGravityWP - Merge Tags

CVE-2025-28911WordPress Gravity 2 PDF plugin <= 3.1.3 - Reflected Cross Site Scripting (XSS) vulnerabilitygravity2pdf Gravity 2 PDF

CVE-2025-13407GravityForms < 2.9.23.1 - Unauthenticated Arbitrary File UploadUnknown Gravity Forms

CVE-2025-12974Gravity Forms <= 2.9.21.1 - Unauthenticated Arbitrary File Upload via Legacy Chunked UploadGravity Forms

CVE-2025-12352Gravity Forms <= 2.9.20 - Unauthenticated Arbitrary File Upload via 'copy_post_image'Gravity Forms

CVE-2024-13845Gravity Forms WebHooks <= 1.6.0 - Authenticated (Admin+) Server-Side Request Forgery via WebhookGravity Forms WebHooks

CVE-2024-13378GravityForms 2.9.0.1 - 2.9.1.3 - Unauthenticated Stored Cross-Site Scripting via 'style_settings' parameterGravity Forms

CVE-2024-13377GravityForms <= 2.9.1.3 - Unauthenticated Stored Cross-Site Scripting via 'alt' parameterGravity Forms

CVE-2024-12446Post to Pdf <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scriptinggravitymaster97 PDF Generator for Posts & Pages – Export…

CVE-2024-0710GP Unique ID <= 1.5.5 - Unauthenticated Form Submission Unique ID ModificationGravity Wiz GP Unique ID

CVE-2023-7049Custom Field For WP Job Manager <= 1.2 - Insecure Direct Object Reference to Sensitive Information Exposure via…gravitymaster97 Custom Field For WP Job Manager

CVE-2023-49761WordPress Product Enquiry for WooCommerce Plugin <= 3.0 is vulnerable to Cross Site Request Forgery (CSRF)Gravity Master Product Enquiry for WooCommerce

CVE-2023-47696WordPress Product Enquiry for WooCommerce Plugin <= 3.0 is vulnerable to Cross Site Scripting (XSS)Gravity Master Product Enquiry for WooCommerce

CVE-2023-47512WordPress Product Enquiry for WooCommerce Plugin <= 3.0 is vulnerable to Cross Site Scripting (XSS)Gravity Master Product Enquiry for WooCommerce

CVE-2023-37980WordPress Custom Field For WP Job Manager Plugin <= 1.1 is vulnerable to Cross Site Scripting (XSS)Gravity Master Custom Field For WP Job Manager

CVE-2023-2701Gravity Forms < 2.7.5 - Reflected XSSUnknown gravityforms

CVE-2023-2326Gravity Forms Google Sheet Connector < 1.3.5 - Access Code Update via CSRFUnknown gsheetconnector-gravityforms-pro

CVE-2015-10117Gravity Forms DPS PxPay Plugin cross site scriptingn/a Gravity Forms DPS PxPay Plugin

33 records, read from the index as it stood on 20 Sep 2026. Every row opens the record it names, and every value on that record opens its own receipt.

Everything on this page is free. Public data. Withholding it protects nothing.