CVE-2026-16649: Gravity Forms <= 2.10.5 - Unauthenticated Stored Cross-Site Scripting via Post Body Field Value
The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Post Body Field Value in all versions up to, and including, 2.10.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit survives save-time sanitization because wpksespost allows the required HTML tags and attributes, and the client-side tooltip script re-parses the browser-decoded aria-label value as innerHTML while only stripping script elements, leaving onerror and other event-handler attributes fully intact and executable.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated attacker can exploit it over the network without user interaction or prior privileges. Exploitation requires the attacker to submit a malicious value through a Post Body field.
Who is exposed to the injected script?
The script executes when a user accesses a page containing the injected content. The vulnerability can affect confidentiality and integrity in the context of the user viewing that page.
Are standard save-time content filters sufficient to prevent exploitation?
No. The payload can survive save-time sanitization because wp_kses_post permits the needed HTML tags and attributes, and the tooltip code later re-parses the decoded aria-label value as innerHTML.
What makes the payload execute despite script-element stripping?
The client-side tooltip script strips script elements but leaves event-handler attributes such as onerror intact. Those attributes can execute when the browser processes the injected HTML.