---
id: "CVE-2026-90437"
kind: "vulnerability"
aliases: ["CVE-2026-90437"]
title: "Gravity Forms WordPress plugin: stored script injection via form fields"
severity: "high"
cvss: 7.2
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "gravityforms", "fixed": ["3.1.2"], "affected": "<= 3.1.1", "ecosystem": "wordpress"}]
ecosystems: []
tags: ["gravity-forms", "package", "self-hosted", "wordpress", "wordpress-plugin", "xss"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-10-30T07:16:34+00:00"
first_seen_at: "2026-10-30T07:29:00+00:00"
updated_at: "2026-10-30T07:31:34+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-90437", "first_seen_at": "2026-10-30T07:29:00+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-30T07:31:34+00:00"}]
---

# Gravity Forms WordPress plugin: stored script injection via form fields

The Gravity Forms WordPress plugin up to and including 3.1.1 stores attacker-supplied HTML in post excerpt, custom field and paragraph fields without proper sanitization. The injected script runs in the browser of any user who opens an affected page, including administrators in the WordPress admin area.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress:gravityforms affected <= 3.1.1 fixed 3.1.2

## How to check

WordPress admin > Plugins: Gravity Forms version <= 3.1.1 is affected. Or run: wp plugin get gravityforms --field=version

## Fix

Update Gravity Forms to 3.1.2 or later (vendor changelog shows 3.2.1 as latest, 2026-10-28). Vendor does not name this CVE; 3.1.2 is from third-party trackers.

## Timeline

- 2026-10-30T07:29:00+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-90437
- 2026-10-30T07:31:34+00:00 analyst — Fix 3.1.2 (2026-09-17) per wordsec/Wordfence-sourced rewrite; vendor changelog lists only 'security enhancements' in 3.1.2 and does not name the CVE, so nothing marked verified. Current release 3.2.1. No exploitation or PoC found; Patchstack expects mass-exploit likelihood.

## Documents

- [describes] wordsec: Gravity Forms <= 3.1.1 unauthenticated stored XSS https://wordsec.net/vulnerabilities/plugins/gravityforms/gravity-forms-311-unauthenticated-stored-cross-site-scripting-via-post-excerpt-post-custom-field-rich-text-paragraph-field-values
- [fix] Gravity Forms Changelog https://docs.gravityforms.com/gravityforms-change-log/

## From the sources

The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Post Excerpt / Post Custom Field / Rich-Text Paragraph Field Values in all versions up to, and including, 3.1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is possible because Post Excerpt, Post Custom Field, and Rich-Text-Editor-enabled Paragraph Text fields allow raw HTML submissions via allow_html(), and an entity-encoded payload stored in a data-dialog-confirm attribute evades wp_kses_post() at save time but is decoded into executable markup by the browser when the plugin's admin JavaScript passes the attribute value to insertAdjacentHTML().

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_