Is CVE-2026-84293 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-84293 being exploited in the wild.

How severe is CVE-2026-84293?

High severity, with a CVSS score of 7.2, published 9 September 2026.

Which products and versions are affected?

Gravity Forms Repeater Fields for Gravity Forms up to and including 3.0.4.

Is there a fix for CVE-2026-84293?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-84293 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-84293?

Check whether you run Gravity Forms Repeater Fields for Gravity Forms at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-84293: Repeater Fields for Gravity Forms stored XSS in multi-input sub-fields

CVE-2026-84293 · Severity: high · CVSS 7.2 · Published 2026-09-09

Repeater Fields for Gravity Forms is a WordPress plugin that allows users to create repeating form field groups within Gravity Forms. The plugin fails to properly sanitize and escape data entered into multi-input sub-fields (such as Name, Address, and Checkbox fields), allowing unauthenticated attackers to inject malicious scripts that execute whenever anyone views the affected form. This could expose user data or compromise website visitors.

Vendors: Gravity Forms.

Quick answers

Is CVE-2026-84293 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-84293 being exploited in the wild.
How severe is CVE-2026-84293?: High severity, with a CVSS score of 7.2, published 9 September 2026.
Which products and versions are affected?: Gravity Forms Repeater Fields for Gravity Forms up to and including 3.0.4.
Is there a fix for CVE-2026-84293?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-84293 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-84293?: Check whether you run Gravity Forms Repeater Fields for Gravity Forms at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a Stored Cross-Site Scripting (XSS) flaw caused by insufficient input sanitization and output escaping in multi-input sub-field values within repeater fields. Unauthenticated attackers can inject arbitrary JavaScript through vulnerable field types (Name, Address, Checkbox, etc.) in versions up to 3.0.4; notably, scalar single-input fields are properly escaped with esc_html() and are not affected. The malicious script is stored server-side and executes for any user accessing the injected page, making this a persistent attack vector. Single-input fields in version 3.0.4 and later have been patched with proper output escaping, but multi-input sub-fields remain vulnerable.

Affected products

Gravity Forms Repeater Fields for Gravity Forms up to and including 3.0.4

Timeline

2026-09-09: disclosed: CVE-2026-84293 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.