Executive brief
Repeater Fields for Gravity Forms is a WordPress plugin that allows users to create repeating form field groups within Gravity Forms. The plugin fails to properly sanitize and escape data entered into multi-input sub-fields (such as Name, Address, and Checkbox fields), allowing unauthenticated attackers to inject malicious scripts that execute whenever anyone views the affected form. This could expose user data or compromise website visitors.
Technical details
The vulnerability is a Stored Cross-Site Scripting (XSS) flaw caused by insufficient input sanitization and output escaping in multi-input sub-field values within repeater fields. Unauthenticated attackers can inject arbitrary JavaScript through vulnerable field types (Name, Address, Checkbox, etc.) in versions up to 3.0.4; notably, scalar single-input fields are properly escaped with esc_html() and are not affected. The malicious script is stored server-side and executes for any user accessing the injected page, making this a persistent attack vector. Single-input fields in version 3.0.4 and later have been patched with proper output escaping, but multi-input sub-fields remain vulnerable.
Affected products
- Gravity Forms Repeater Fields for Gravity Forms up to and including 3.0.4
Timeline
- 2026-09-09: disclosed: CVE-2026-84293 published