CVE-2026-4394

The Gravity Forms plugin for WordPress versions up to 2.9.30 contains a stored cross-site scripting (XSS) vulnerability in the Credit Card field's Card Type sub-field. The vulnerability exists because the plugin fails to sanitize user input when accepting the Card Type parameter via POST request and does not escape the value when displaying it in the WordPress dashboard, allowing unauthenticated attackers to inject malicious scripts that execute when administrators view form entries. The vulnerability presents a medium severity risk with a CVSS score of 6.1, featuring a network-based attack vector with low complexity and no authentication requirement. The attack requires user interaction (administrator viewing the entry) and can result in limited confidentiality and integrity impacts. The exploitation window is relatively constrained since attackers must trick users into submitting a specially crafted form with the malicious Card Type payload. There is currently no evidence of active exploitation in the wild, with an EPSS score of 0.00026 indicating minimal probability of exploitation. The vulnerability is not listed on the KEV catalog and shows no recent activity on security hot lists. However, organizations using affected versions should prioritize updating to patched releases, as the attack vector is straightforward and does not require sophisticated techniques once the vulnerability mechanism is understood.