{"id":"CVE-2026-90437","kind":"vulnerability","aliases":["CVE-2026-90437"],"related":[],"title":"Gravity Forms WordPress plugin: stored script injection via form fields","description":"The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Post Excerpt / Post Custom Field / Rich-Text Paragraph Field Values in all versions up to, and including, 3.1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is possible because Post Excerpt, Post Custom Field, and Rich-Text-Editor-enabled Paragraph Text fields allow raw HTML submissions via allow_html(), and an entity-encoded payload stored in a data-dialog-confirm attribute evades wp_kses_post() at save time but is decoded into executable markup by the browser when the plugin's admin JavaScript passes the attribute value to insertAdjacentHTML().","summary":"The Gravity Forms WordPress plugin up to and including 3.1.1 stores attacker-supplied HTML in post excerpt, custom field and paragraph fields without proper sanitization. The injected script runs in the browser of any user who opens an affected page, including administrators in the WordPress admin area.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"gravityforms","fixed":["3.1.2"],"affected":"<= 3.1.1","ecosystem":"wordpress"}],"ecosystems":[],"tags":["gravity-forms","package","self-hosted","wordpress","wordpress-plugin","xss"],"not_affected_if":["plugin-not-installed"],"how_to_check":"WordPress admin > Plugins: Gravity Forms version <= 3.1.1 is affected. Or run: wp plugin get gravityforms --field=version","fix":"Update Gravity Forms to 3.1.2 or later (vendor changelog shows 3.2.1 as latest, 2026-10-28). Vendor does not name this CVE; 3.1.2 is from third-party trackers.","status":"open","published_at":"2026-10-30T07:16:34+00:00","first_seen_at":"2026-10-30T07:29:00+00:00","triaged_at":"2026-10-30T07:30:07+00:00","updated_at":"2026-10-30T07:31:34+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-30T07:30:07Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Gravity Forms WordPress plugin: stored script injection via form fields","impact":"medium","summary":"The Gravity Forms WordPress plugin up to and including 3.1.1 stores attacker-supplied HTML in post excerpt, custom field and paragraph fields without proper sanitization. The injected script runs in the browser of any user who opens an affected page, including administrators in the WordPress admin area.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","gravity-forms","self-hosted"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker script runs in admin browsers, enabling account takeover","analyst_note":"Confirm the fixed version from the Gravity Forms changelog or the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-90437.","how_to_check":"- Check the installed Gravity Forms plugin version in the WordPress admin under Plugins.\n- Confirm whether the installed version is `3.1.1` or earlier.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Gravity Forms plugin at version 3.1.1 or earlier on WordPress. Unauthenticated attackers can submit the payload, so exposure depends on whether the site accepts those submissions. Sites without the plugin, or on a newer version, can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000715,"input_tokens":4335,"output_tokens":562,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed version from the Gravity Forms changelog or the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-90437.","search":"'-2026':12A,15A '-90437':13A,16A '3.1.1':39B,111C 'access':140C 'admin':76B,203C 'administr':72B 'affect':69B 'allow':162C,167C 'arbitrari':129C 'area':77B 'attack':42B,126C 'attacker-suppli':41B 'attribut':182C,207C 'browser':62B,198C 'confirm':181C 'cross':89C 'cross-sit':88C 'custom':48B,96C,151C 'cve':11A,14A 'data':179C 'data-dialog-confirm':178C 'decod':192C 'dialog':180C 'due':112C 'editor':157C 'enabl':158C 'encod':173C 'entiti':172C 'entity-encod':171C 'escap':119C 'evad':183C 'excerpt':47B,94C,149C 'execut':136C,194C 'field':10A,49B,52B,97C,102C,152C,161C 'form':2A,9A,20B,32B,80C 'graviti':1A,19B,31B,79C 'gravity-form':18B 'gravityforms':17A 'host':24B 'html':44B,164C,168C 'includ':38B,71B,110C 'inject':7A,57B,128C,142C 'input':115C 'insertadjacenthtml':210C 'insuffici':114C 'javascript':204C 'kses':185C 'make':121C 'markup':195C 'open':67B 'output':118C 'packag':21B 'page':70B,133C,143C 'paragraph':51B,101C,159C 'pass':205C 'payload':174C 'plugin':4A,28B,34B,81C,201C 'possibl':123C,146C 'post':46B,93C,95C,148C,150C,186C 'proper':54B 'raw':163C 'rich':99C,155C 'rich-text':98C 'rich-text-editor-en':154C 'run':59B 'sanit':55B,116C 'save':188C 'script':6A,58B,91C,131C 'self':23B 'self-host':22B 'site':90C 'store':5A,40B,87C,175C 'submiss':165C 'suppli':43B 'text':100C,156C,160C 'time':189C 'unauthent':125C 'user':65B,139C 'valu':103C,208C 'version':106C 'via':8A,92C,166C 'vulner':85C 'web':130C 'whenev':137C 'without':53B 'wordpress':3A,25B,27B,33B,75B,83C 'wordpress-plugin':26B 'wp':184C 'xss':29B","nicknames":[],"mitigations":[],"who_affected":"WordPress sites running Gravity Forms 3.1.1 or earlier. Unauthenticated visitors can submit forms whose Post Excerpt, Post Custom Field or rich-text Paragraph values carry script that is stored and runs in the browser of anyone who opens the affected page, including admins. Sites on 3.1.2 or later, or without Gravity Forms, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T07:16:34+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-90437","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90437","severity":null,"published_at":"2026-10-30T07:16:34+00:00","modified_at":"2026-10-30T07:16:34+00:00","first_seen_at":"2026-10-30T07:29:00+00:00","fetched_at":"2026-10-30T07:29:00+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-90437:1134","url":null,"severity":null,"published_at":"2026-10-30T07:31:34+00:00","modified_at":"2026-10-30T07:31:34+00:00","first_seen_at":"2026-10-30T07:31:34+00:00","fetched_at":"2026-10-30T07:31:34+00:00","note":"Fix 3.1.2 (2026-09-17) per wordsec/Wordfence-sourced rewrite; vendor changelog lists only 'security enhancements' in 3.1.2 and does not name the CVE, so nothing marked verified. Current release 3.2.1. No exploitation or PoC found; Patchstack expects mass-exploit likelihood."}],"documents":[{"id":22080,"url":"https://docs.gravityforms.com/gravityforms-change-log/","title":"Gravity Forms Changelog","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":22083,"url":"https://wordsec.net/vulnerabilities/plugins/gravityforms/gravity-forms-311-unauthenticated-stored-cross-site-scripting-via-post-excerpt-post-custom-field-rich-text-paragraph-field-values","title":"wordsec: Gravity Forms <= 3.1.1 unauthenticated stored XSS","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}