CVE-2014-4536

6.1 mediumEPSS 3.9%

Multiple cross-site scripting (XSS) vulnerabilities in tests/notAuto_test_ContactService_pauseCampaign.php in the Infusionsoft Gravity Forms plugin before 1.5.6 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) go, (2) contactId, or (3) campaignId parameter.

Severity

CVSS 3.1

6.1 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS: 3.9% chance of exploitation in the next 30 days; higher than 90% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2019-12-27
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

katz:infusionsoft_gravity_forms

References

http://codevigilant.com/disclosure/wp-plugin-infusionsoft-a3-cross-site-scripting-xss
http://wordpress.org/plugins/infusionsoft/changelog
http://codevigilant.com/disclosure/wp-plugin-infusionsoft-a3-cross-site-scripting-xss
http://wordpress.org/plugins/infusionsoft/changelog

Check your stack JSON