{
 "id": "WPSEC-2026-1905",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1905/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1905/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1905/index.md",
 "title": "Alpha Addons for Gravity Forms <= 1.0.3 - Unauthenticated CSV Injection via Google Sheet Feed",
 "description": "The Alpha Addons for Gravity Forms plugin for WordPress is vulnerable to CSV (formula) injection via form submissions sent to Google Sheets in all versions up to, and including, 1.0.3, due to submitted field values being appended to the connected sheet with USER_ENTERED parsing and without neutralizing values that begin with formula characters such as =, +, @ or -. This makes it possible for unauthenticated attackers to inject formulas into the connected spreadsheet when a Google Sheet feed is enabled for a form. The formulas run when the sheet is opened and can expose or alter data in it.",
 "plugin": {
  "slug": "alpha-addons-for-gravity-forms",
  "name": "Alpha Addons for Gravity Forms",
  "full_name": "Alpha Addons for Gravity Forms",
  "wordpress_org": "https://wordpress.org/plugins/alpha-addons-for-gravity-forms/",
  "advisories_url": "https://wpsec.com/vuln/plugin/alpha-addons-for-gravity-forms/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/alpha-addons-for-gravity-forms"
 },
 "type": "CSV INJECTION",
 "cwe": [
  "CWE-1236"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.4,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "1.0.4",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 1.0.4"
  ]
 },
 "introduced_in": null,
 "fixed_in": "1.0.4",
 "remediation": "Update to 1.0.4 or later.",
 "fix_released": "2026-10-28T06:14:40+00:00",
 "published": "2026-10-29T06:44:57+00:00",
 "updated": "2026-10-28T09:12:20.845270+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1905/",
  "https://plugins.svn.wordpress.org/alpha-addons-for-gravity-forms/tags/1.0.4/",
  "https://wordpress.org/plugins/alpha-addons-for-gravity-forms/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/alpha-addons-for-gravity-forms",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-29"
 }
}