CVE-2026-97645

HIGH 7.2

Gravity Forms <= 3.1.2 - Unauthenticated Stored Cross-Site Scripting via List Field

CVSS Score

7.2

EPSS Score

0.2%

EPSS Percentile

9th

The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via List Field in all versions up to, and including, 3.1.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires the administrator to click the injected link in the entry detail view and confirm a dialog, which triggers the admin JavaScript bundle's delegated data-dialog-callback handler to invoke the attacker-supplied function reference.

CWE	CWE-79
Vendor	gravity forms
Product	gravity forms
Published	Oct 30, 2026
Last Updated	Oct 30, 2026

Stay Ahead of the Next One

Get instant alerts for gravity forms gravity forms

Be the first to know when new high vulnerabilities affecting gravity forms gravity forms are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

Gravity Forms / Gravity Forms

0 ≤ 3.1.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

wordfence.com: https://www.wordfence.com/threat-intel/vulnerabilities/id/9889e718-381b-4d11-a234-0278037c61c4?source=cve docs.gravityforms.com: https://docs.gravityforms.com/

Credits

Supakiad S. (m3ez)