Loading vulnerability…
The Gravity Forms plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the form_ids parameter in the gform_get_config AJAX action in all versions up to, and including, 2.9.30. This is due to the GFCommon::send_json() method outputting JSON-encoded data wrapped in HTML comment delimiters using echo and wp_die(), which serves the response with a Content-Type: text/html header instead of application/json. The wp_json_encode() function does not HTML-encode angle brackets within JSON string values, allowing injected HTML/script tags in form_ids array values to be parsed and executed by the browser. The required config_nonce is generated with wp_create_nonce('gform_config_ajax') and is publicly embedded on every page that renders a Gravity Forms form, making it identical for all unauthenticated visitors within the same 12-hour nonce tick. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This vulnerability cannot be exploited against users who are authenticated on the target system, but could be used to alter the target page.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository is a small standalone exploit PoC for CVE-2026-4406 affecting the Gravity Forms WordPress plugin. It contains two files: a detailed README documenting the vulnerability, root cause, affected versions, exploitation conditions, and remediation; and xss-poc.html, an interactive browser-based exploit page. The exploit targets the unauthenticated WordPress AJAX endpoint /wp-admin/admin-ajax.php with action=gform_get_config. It abuses the args POST parameter, specifically the JSON form_ids array, by inserting attacker-controlled HTML/JavaScript that is reflected into the response without sanitization or output encoding. Because the response is served as text/html, the browser parses the reflected content as active HTML, enabling reflected XSS. The HTML PoC is operational rather than merely descriptive. It lets the operator specify a target base URL, optionally provide or refresh a Gravity Forms nonce, choose from preset payloads or enter a custom payload, then submit a crafted POST form to the vulnerable endpoint. The exploit opens a popup window first to avoid popup blocking and submits the malicious request into that window because iframe rendering may be blocked by SAMEORIGIN protections. The code constructs fields including action=gform_get_config, args with the injected form_ids payload, config_path, query_string, and optionally gform_ajax_nonce. Main exploit capabilities: arbitrary JavaScript execution in the target origin, proof-of-execution alerts, cookie/session access demonstrations, DOM takeover/overlay, and described support for exfiltration callbacks. The repository is not part of a larger exploit framework and is clearly a real exploit PoC, not a detection-only script.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
No public activity tracked yet. Mallory keeps watching.
No public activity observed for this vulnerability.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.