CVE-2026-97645: Gravity Forms <= 3.1.2 - Unauthenticated Stored Cross-Site Scripting via List Field
The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via List Field in all versions up to, and including, 3.1.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires the administrator to click the injected link in the entry detail view and confirm a dialog, which triggers the admin JavaScript bundle's delegated data-dialog-callback handler to invoke the attacker-supplied function reference.
Event History
Frequently Asked Questions
Who is exposed to this issue?
WordPress sites using Gravity Forms versions up to and including 3.1.2 are affected. An attacker does not need authentication to submit the malicious List Field content.
What must happen for the injected script to execute?
An administrator must open the affected entry's detail view, click the injected link, and confirm the resulting dialog. This causes the admin JavaScript handler to invoke the attacker-supplied function reference.
Is simply viewing an injected entry enough to trigger exploitation?
No. The described attack requires administrator interaction with the injected link and confirmation of a dialog in the entry detail view.