Executive brief
Gravity Forms is a popular WordPress plugin used to create and manage web forms. The plugin contains a vulnerability that allows attackers to inject malicious scripts into form fields. When site visitors view pages containing injected forms, the malicious scripts execute in their browsers, potentially compromising user data or session integrity without requiring any form of authentication.
Technical details
The vulnerability is a Stored Cross-Site Scripting (XSS) flaw in the Post Body Field that results from insufficient input sanitization and output escaping. Attackers can inject arbitrary HTML/JavaScript through form field values; the injected payload persists because wp_kses_post allows certain HTML tags and attributes. The client-side tooltip script re-parses aria-label values as innerHTML, stripping only script tags but leaving event handlers (e.g., onerror) intact and executable. This affects all versions up to and including 2.10.5. The vulnerability is network-accessible and requires no authentication or user interaction beyond normal site visitation to trigger.
Affected products
- Gravity Forms Gravity Forms up to and including 2.10.5
Timeline
- 2026-09-05: disclosed
- 2026-09-17: patched: Security enhancements added in version 3.1.2