CVE-2026-4406 | Gravity Forms Plugin up to 2.9.30 on WordPress Content-Type GFCommon::send_json form_ids cross site scripting (CNNVD-202604-1897)

A vulnerability classified as problematic was found in Gravity Forms Plugin up to 2.9.30 on WordPress. The impacted element is the function GFCommon::send_json of the component Content-Type Handler. Executing a manipulation of the argument form_ids can lead to cross site scripting. This vulnerability appears as CVE-2026-4406. The attack may be performed from remote. There is no available exploit.