Live › vulnerability › CVE-2026-90437
The Gravity Forms WordPress plugin up to and including 3.1.1 stores attacker-supplied HTML in post excerpt, custom field and paragraph fields without proper sanitization. The injected script runs in the browser of any user who opens an affected page, including administrators in the WordPress admin area.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 07:29 UTC. All times on this page are UTC.
WordPress sites running Gravity Forms 3.1.1 or earlier. Unauthenticated visitors can submit forms whose Post Excerpt, Post Custom Field or rich-text Paragraph values carry script that is stored and runs in the browser of anyone who opens the affected page, including admins. Sites on 3.1.2 or later, or without Gravity Forms, can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| gravityforms | wordpress | <= 3.1.1 | 3.1.2 |
3.1.1 is affected3.1.2 or later (vendor changelog shows as latest, 2026-10-28)3.2.13.1.2 is from third-party trackersEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Post Excerpt / Post Custom Field / Rich-Text Paragraph Field Values in all versions up to, and including, 3.1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is possible because Post Excerpt, Post Custom Field, and Rich-Text-Editor-enabled Paragraph Text fields allow raw HTML submissions via allow_html(), and an entity-encoded payload stored in a data-dialog-confirm attribute evades wp_kses_post() at save time but is decoded into executable markup by the browser when the plugin's admin JavaScript passes the attribute value to insertAdjacentHTML().
This page as .md · .json · in your agent: get_signal("CVE-2026-90437")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.