Description

The Gravity Booster – Styles & Layouts for Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 5.26 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.4",
  "pubDate": "2026-08-16T05:16:45.810Z",
  "pubdate": "2026-08-16T05:16:45.810Z",
  "executiveSummary": "An authenticated Stored Cross-Site Scripting (XSS) vulnerability exists within the Gravity Booster – Styles & Layouts for Gravity Forms plugin for WordPress in all versions up to, and including, 5.26.\nThe flaw stems from insufficient input sanitization and output escaping within the plugin's administrative settings interface.\nThis security deficiency allows authenticated attackers possessing editor-level permissions and above to inject arbitrary web scripts into administrative settings pages.\nThe injected scripts subsequently execute within the context of any user accessing the affected page.\nThe vulnerability specifically impacts WordPress multi-site installations and environments where the unfiltered_html capability has been explicitly disabled.\nSuccessful exploitation enables malicious actors to leverage elevated privileges, potentially leading to unauthorized administrative actions, session hijacking, or further compromise of the affected WordPress site.",
  "technicalDetails": "The root cause of the vulnerability resides in the inadequate processing of user-supplied input submitted through the administrative settings of the Gravity Booster – Styles & Layouts for Gravity Forms plugin.\nSpecifically, the affected component fails to properly sanitize input data and subsequently omits necessary output escaping mechanisms when rendering stored values in the user interface.\nThe affected versions encompass all iterations of the plugin up to, and including, version 5.26.\nExploitation of this vulnerability requires authenticated access with editor-level permissions or higher, alongside specific environmental conditions such as multi-site configurations or instances where the unfiltered_html capability is disabled.\nThe attack flow proceeds as follows: an authenticated attacker with the requisite administrative or editor privileges navigates to the vulnerable administrative settings interface provided by the plugin.\nThe attacker then supplies a malicious payload containing arbitrary web scripts (such as JavaScript) within the administrative settings input fields.\nBecause the plugin fails to enforce proper input sanitization before persisting the data to the database, the malicious script is stored successfully.\nSubsequently, whenever an administrator or authorized user accesses the injected administrative page, the stored payload is rendered without proper output escaping.\nThe browser of the viewing user executes the arbitrary web script within the context of their active session.\nPost-exploitation impact depends on the privileges of the victim viewing the injected page, potentially allowing the attacker to perform privileged actions, manipulate site content, or execute administrative tasks via the compromised session."
}