Stored Cross-Site Scripting in Gravity Forms Plugin for WordPress

CVE-2026-3492

What is CVE-2026-3492?

The Gravity Forms plugin for WordPress is susceptible to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping. This vulnerability arises from a failure to properly authorize on the create_from_template AJAX endpoint, enabling any authenticated user to create forms. This security flaw allows attackers with Subscriber-level access or higher to inject malicious JavaScript, which can execute when an Administrator interacts with the Form Switcher dropdown within the Form Editor. Ensuring proper input handling and robust authorization checks is critical to mitigating this risk.

References