Stored Cross-Site Scripting Vulnerability in Gravity Forms Plugin for WordPress
CVE-2026-90437

7.2HIGH

Key Information:

Vendor

WordPress
Status
Gravity Forms
Vendor
CVE Published:
30 October 2026

What is CVE-2026-90437?

The Gravity Forms plugin for WordPress exhibits a vulnerability that allows unauthenticated attackers to perform stored cross-site scripting via specific fields such as Post Excerpt, Post Custom Field, and Rich-Text Paragraph Field values. This issue arises from inadequate input sanitization and output escaping, which permits the entry of raw HTML content. The vulnerabilities enable the injection of arbitrary web scripts into web pages, which are triggered when users access those pages. Attackers can evade security measures through the use of entity-encoded payloads stored in attributes that are processed incorrectly, leading to the execution of malicious scripts. Users are advised to ensure they are running secure versions and implement proper measures to mitigate risks.

Affected Version(s)

Gravity Forms 0 <= 3.1.1

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://docs.gravityforms.com/

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

daroo
.