CVE-2023-2701

The Gravity Forms WordPress plugin before 2.7.5 does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting which could be used against high-privileged users such as admin.

Affected products

Gravity Forms

Mediaburst Gravity Forms

< 2.7.5

Fix

Available

CVSS 3.1

6.1 MEDIUM

EPSS

0.5% (40th percentile)

NVD status

Modified

Published

2023-07-17