Gravity Forms: Stored Cross-Site Scripting (CVE-2026-97645)
The Gravity Forms plugin for WordPress (all versions up to, and including, 3.1.2) is vulnerable to Stored Cross-Site Scripting (XSS) via the List Field due to insufficient input sanitization and output escaping.
CVE search metadata
CVE search record: CVE-2026-97645. Severity: high. CVSS: 7.2. KEV: no. Product: Gravity Forms (<= 3.1.2). Brief: Gravity Forms: Stored Cross-Site Scripting (CVE-2026-97645). Brief link: https://feed.craftedsignal.io/briefs/2026-10-gravity-forms-xss-d96f0cfe/
Triage facts
Revision 1- Applicability
- Gravity Forms (<= 3.1.2)
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Oct 30, 09:27 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the List Field in all versions up to, and including, 3.1.2. This vulnerability stems from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary web scripts. The injected scripts execute when an administrator accesses an injected page, clicks the injected link in the entry detail view, and confirms a dialog. This action triggers the admin JavaScript bundle's delegated data-dialog-callback handler to invoke the attacker-supplied function reference.