CVE-2020-27850: Gravity Forms stored Cross-Site Scripting (XSS) vulnerability
Summary
CVE-2020-27850: Gravity Forms stored Cross-Site Scripting (XSS) vulnerability. Affects wp-premium/gravityforms versions >= 2.4, < 2.4.21. Fixed in 2.4.21. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Gravity Forms is a premium WordPress plugin that allows users to create and manage forms on their websites. It provides a user-friendly interface for creating contact forms, surveys, quizzes, and other types of forms. The plugin is widely used and trusted by many WordPress site owners for its robust features and ease of use. However, a vulnerability has been discovered in the forms import feature of Gravity Forms before version 2.4.21.
Vulnerability Detail
The vulnerability is a stored Cross-Site Scripting (XSS) issue that allows remote attackers to inject arbitrary web script or HTML via the import of a Gravity Forms (GF) form. This means that an attacker can craft a malicious form and trick a user with privileged roles (such as Administrator or Editor) into importing it, resulting in the execution of the injected code. The impact of this vulnerability can range from defacement of the website to the theft of sensitive user information.
How To Fix
Minimum fixed version
2.4.21
This is the first release that contains the fix.
composer require wp-premium/gravityforms:2.4.21Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you are unable to immediately update to the latest version of Gravity Forms, a temporary workaround is to disable the forms import feature or restrict access to it. This can be done by modifying the plugin's settings or using a security plugin that allows granular control over Gravity Forms functionality.
Conclusion
The Gravity Forms stored Cross-Site Scripting (XSS) vulnerability poses a risk to websites using versions prior to 2.4.21. It is crucial to update the plugin to the latest version to mitigate the risk of exploitation. If you require further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for wp-premium/gravityforms →
FAQ
Gravity Forms is a popular WordPress plugin that enables users to create and manage forms on their websites.
A stored XSS vulnerability allows an attacker to inject malicious code into a web application, which is then stored and executed by other users who access the affected page or feature.
The consequences of this vulnerability can vary, but they may include website defacement, data theft, or the compromise of user accounts.
Updating to the latest version of Gravity Forms (2.4.21 or later) is the best way to protect your website. Additionally, you can disable the forms import feature or restrict access to it as a temporary workaround.
Yes, the CVSS score for this vulnerability is 4.8, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for wp-premium/gravityforms.
