Executive brief
The Magic Conversation For Gravity Forms plugin for WordPress, which adds interactive conversational features to web forms, contains a security flaw. This vulnerability allows users with contributor-level access or higher to inject malicious scripts into website pages. When other users or administrators visit these pages, the scripts can execute, potentially leading to unauthorized actions or data theft.
Technical details
The Magic Conversation For Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping on user-supplied attributes within the 'magic-conversation' shortcode. This vulnerability is classified as CWE-79. An authenticated attacker with contributor-level permissions or higher can exploit this by injecting arbitrary web scripts into pages. These scripts will execute in the context of a user's browser whenever they access the affected page. The issue exists in all versions up to 3.0.97; a changeset (3482359) indicates that a fix has been developed.
Affected products
- magicplugins Magic Conversation For Gravity Forms up to, and including, 3.0.97
Timeline
- 2026-04-08: disclosed
- 2026-04-08: advisory
References
- https://plugins.trac.wordpress.org/browser/magic-conversation-for-gravity-forms/tags/3.0.96/main.php
- https://plugins.trac.wordpress.org/browser/magic-conversation-for-gravity-forms/trunk/main.php
- https://plugins.trac.wordpress.org/changeset/3482359/magic-conversation-for-gravity-forms/trunk/main.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/bc425c4a-cb4e-4f50-b85b-8c4c7778c073?source=cve