Description

The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Post Body Field Value in all versions up to, and including, 2.10.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit survives save-time sanitization because wp_kses_post allows the required HTML tags and attributes, and the client-side tooltip script re-parses the browser-decoded aria-label value as innerHTML while only stripping script elements, leaving onerror and other event-handler attributes fully intact and executable.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-09-05T07:17:10.917Z",
  "pubdate": "2026-09-05T07:17:10.917Z",
  "executiveSummary": "The Gravity Forms plugin for WordPress, in versions up to and including 2.10.5, is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability. This flaw arises from inadequate input sanitization and output escaping mechanisms within the plugin's handling of Post Body Field Values.\nThe vulnerability allows unauthenticated attackers to inject malicious JavaScript payloads that are persisted within the application database. When an administrator or authorized user views a page containing the injected content, the payload executes within the context of their session.\nThis vulnerability poses a significant risk to the integrity and security of the affected WordPress site. Successful exploitation permits an attacker to perform unauthorized actions on behalf of the victim, potentially leading to administrative account takeover, data exfiltration, or further site compromise. Because the vulnerability allows for unauthenticated interaction, it presents a critical attack vector for public-facing forms. Remediation requires an immediate update to the latest patched version of the software to prevent persistent code execution.",
  "technicalDetails": "The root cause of this vulnerability is a multi-stage failure in input handling and client-side DOM processing. While the backend implementation utilizes wp_kses_post for sanitization, this function is insufficient for this specific use case because it permits specific HTML tags and attributes that are later mishandled by the plugin's frontend scripts.\nThe attack vector centers on the Post Body Field Value. An attacker can submit a crafted payload through a public-facing form. The backend logic accepts the malicious input because the allowed tag whitelist in wp_kses_post does not sufficiently restrict attributes that can trigger event handlers. Specifically, while the server-side validation is bypassed, the vulnerability is finalized in the browser.\nThe plugin employs a client-side tooltip script that retrieves values from the DOM, specifically targeting the aria-label attribute. Upon retrieval, the script performs an unsafe re-parsing operation where it treats the browser-decoded content of the aria-label as HTML via an innerHTML assignment. Although the client-side script attempts to strip <script> elements, it fails to account for event-handler injection. Consequently, attributes such as 'onerror', 'onload', or 'onmouseover' remain intact and are rendered directly into the DOM.\nThe attack flow follows these steps: 1) The unauthenticated attacker crafts a payload utilizing an event-handler attribute (e.g., <img src=x onerror=alert(1)>) within an aria-label or similar field context. 2) The payload is submitted to the server and stored in the database, successfully bypassing wp_kses_post filters. 3) A privileged user navigates to the administrative or front-end page where the tooltip script is invoked to display the stored field value. 4) The plugin’s JavaScript retrieves the malicious string from the aria-label attribute. 5) The script injects the string into the DOM via innerHTML, triggering the malicious event handler in the context of the user’s authenticated session. This leads to the execution of arbitrary JavaScript, which can be leveraged to steal session cookies, perform unauthorized administrative actions, or inject additional malware into the WordPress environment."
}