{"id":"CVE-2026-110884","kind":"vulnerability","aliases":["CVE-2026-110884"],"related":[],"title":"Live Summary for Gravity Forms: reflected XSS runs script in visitors' browsers","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in geekontheroad Live Summary for Gravity Forms live-summary-for-gravity-forms allows Reflected XSS.This issue affects Live Summary for Gravity Forms: from n/a through 1.2.10.","summary":"Live Summary for Gravity Forms, a WordPress plugin, fails to escape input in generated pages, allowing reflected cross-site scripting. An attacker can get a victim to open a crafted link and run script in their browser session.","severity":"high","cvss":7.1,"epss":0.00205,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["gravity-forms","package","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check whether the `live-summary-for-gravity-forms` plugin is installed and its version (WordPress admin > Plugins, or `wp plugin get live-summary-for-gravity-forms --field=version`)\n- Versions up to and including `1.2.10` are reported affected","fix":"- Update `live-summary-for-gravity-forms` to a version newer than `1.2.10` once the vendor releases one\n- Until then, deactivate the plugin if it is not essential","status":"open","published_at":"2026-10-21T10:16:55+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-25T03:31:54+00:00","updated_at":"2026-10-25T03:31:54+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:31:54Z","model":"claude-haiku-5-5","output":{"fix":"- Update `live-summary-for-gravity-forms` to a version newer than `1.2.10` once the vendor releases one\n- Until then, deactivate the plugin if it is not essential","reach":"internet","title":"Live Summary for Gravity Forms: reflected XSS runs script in visitors' browsers","impact":"medium","summary":"Live Summary for Gravity Forms, a WordPress plugin, fails to escape input in generated pages, allowing reflected cross-site scripting. An attacker can get a victim to open a crafted link and run script in their browser session.","category":"package","nicknames":[],"who_cares":["wordpress","gravity-forms","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Script runs in victim's browser, session data can be stolen","analyst_note":"Confirm the fixed version and affected parameter from the vendor or the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-110884.","how_to_check":"- Check whether the `live-summary-for-gravity-forms` plugin is installed and its version (WordPress admin > Plugins, or `wp plugin get live-summary-for-gravity-forms --field=version`)\n- Versions up to and including `1.2.10` are reported affected","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Live Summary for Gravity Forms WordPress plugin at version 1.2.10 or earlier are exposed. The flaw is reflected, so it needs a crafted link that a logged-in user or visitor is tricked into opening. Sites that do not run this plugin can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000645,"input_tokens":3373,"output_tokens":615,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-110884':15A,18A '-2026':14A,17A '1.2.10':105C 'affect':96C 'allow':42B,92C 'attack':49B 'browser':12A,64B 'craft':57B 'cross':45B,75C 'cross-sit':44B,74C 'cve':13A,16A 'escap':37B 'fail':35B 'form':5A,21B,31B,85C,91C,101C 'geekontheroad':80C 'generat':40B,73C 'get':51B 'graviti':4A,20B,30B,84C,90C,100C 'gravity-form':19B 'host':25B 'improp':66C 'input':38B,69C 'issu':95C 'link':58B 'live':1A,27B,81C,87C,97C 'live-summary-for-gravity-form':86C 'n/a':103C 'neutral':67C 'open':55B 'packag':22B 'page':41B,72C 'plugin':34B 'reflect':6A,43B,93C 'run':8A,60B 'script':9A,47B,61B,77C 'self':24B 'self-host':23B 'session':65B 'site':46B,76C 'summari':2A,28B,82C,88C,98C 'victim':53B 'visitor':11A 'vulner':78C 'web':71C 'wordpress':26B,33B 'xss':7A 'xss.this':94C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Live Summary for Gravity Forms WordPress plugin at version 1.2.10 or earlier are exposed. The flaw is reflected, so it needs a crafted link that a logged-in user or visitor is tricked into opening. Sites that do not run this plugin can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T10:16:55+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110884","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110884","severity":null,"published_at":"2026-10-21T10:16:55+00:00","modified_at":"2026-10-21T14:26:26+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-110884","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110884","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}