CVE-2026-110884: WordPress Live Summary for Gravity Forms plugin <= 1.2.10 - Cross Site Scripting (XSS) vulnerability

Q: What does an attacker need to exploit this issue?

The vulnerability is reflected XSS with network access, low attack complexity, no required privileges, and user interaction required. An attacker would need to cause a user to interact with a crafted request or page content.

Q: What is the potential impact if exploitation succeeds?

The reported CVSS vector indicates low-impact compromise of confidentiality, integrity, and availability, with scope changed. The issue could affect a victim’s browser session in the context where the vulnerable plugin output is rendered.

Q: Which plugin versions are affected?

Live Summary for Gravity Forms versions through 1.2.10 are affected. The available data does not identify a fixed version.

Published Oct 21, 2026

Updated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in geekontheroad Live Summary for Gravity Forms live-summary-for-gravity-forms allows Reflected XSS.This issue affects Live Summary for Gravity Forms: from n/a through 1.2.10.

Affected Software

1 affected component

geekontheroad Live Summary for Gravity Forms<=1.2.10

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade live-summary-for-gravity-forms to a version that resolves this vulnerability.
Fixed in 1.2.11

Event History

Oct 21, 2026

CVE Published

via MITRE·09:10 AM

Data Sourced

via MITRE·09:10 AM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What does an attacker need to exploit this issue?

The vulnerability is reflected XSS with network access, low attack complexity, no required privileges, and user interaction required. An attacker would need to cause a user to interact with a crafted request or page content.

What is the potential impact if exploitation succeeds?