CVE-2026-90437: Gravity Forms <= 3.1.1 - Unauthenticated Stored Cross-Site Scripting via Post Excerpt / Post Custom Field / Rich-Text Paragraph Field Values
The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Post Excerpt / Post Custom Field / Rich-Text Paragraph Field Values in all versions up to, and including, 3.1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is possible because Post Excerpt, Post Custom Field, and Rich-Text-Editor-enabled Paragraph Text fields allow raw HTML submissions via allowhtml(), and an entity-encoded payload stored in a data-dialog-confirm attribute evades wpksespost() at save time but is decoded into executable markup by the browser when the plugin's admin JavaScript passes the attribute value to insertAdjacentHTML().
Event History
Frequently Asked Questions
Which installations are exposed to this issue?
Gravity Forms for WordPress versions up to and including 3.1.1 are affected. Exploitation requires use of Post Excerpt, Post Custom Field, or Paragraph Text fields with the rich-text editor enabled.
Does an attacker need an account or user interaction to submit a malicious payload?
No attacker authentication or victim interaction is required for submission. The stored script executes when a user accesses an injected page.
What is the impact if exploitation succeeds?
An attacker can store arbitrary web script in affected field values. The script runs in the browser of users who visit the injected page, with low confidentiality and integrity impact indicated by the supplied vector.
How can administrators determine whether they may already be affected?
Review forms that use Post Excerpt, Post Custom Field, or rich-text-enabled Paragraph Text fields, and inspect submitted or generated content for unexpected HTML or encoded payloads. The described bypass uses entity-encoded content stored in a data-dialog-confirm attribute.