CVE-2023-2701 | BDVDB-2026-207451 Detail

gravityforms

Description#

The Gravity Forms WordPress plugin before 2.7.5 does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting which could be used against high-privileged users such as admin.

Impact#

No impact statement in the source data.

Weaknesses#

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

References#

https://wpscan.com/vulnerability/298fbe34-62c2-4e56-9bdb-90da570c5bbe

Exploit#

https://wpscan.com/vulnerability/298fbe34-62c2-4e56-9bdb-90da570c5bbe

History#

Version 12023-07-17Record published in the CVE List.
Version 22024-10-30Most recent update recorded in the CVE List.