PT-2026-24658 · Gravity Forms · Gravity Forms

Mikemyers · Publicado 2026-03-11 · Atualizado 2026-03-15 · CVE-2026-3492

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Gravity Forms versions prior to 2.9.28.1

Description The Gravity Forms plugin for WordPress is susceptible to Stored Cross-Site Scripting. This is caused by a combination of issues: missing authorization on the create from template API endpoint, which allows any authenticated user to create forms; inadequate input sanitization using sanitize text field(), which allows single quotes; and a lack of output escaping when the form title is displayed in the Form Switcher dropdown, where the title attribute is constructed without esc attr(), and the JavaScript saferHtml utility does not escape quotes. This allows authenticated attackers with Subscriber-level access or higher to inject arbitrary JavaScript that will execute when an Administrator searches within the Form Switcher dropdown in the Form Editor.

Recommendations Update Gravity Forms to version 2.9.28.1 or later.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2026-3492

Produtos afetados

Gravity Forms

Referências · 5

• https://docs.gravityforms.com/gravityforms-change-log · Nota
• https://t.me/CVEtracker/47119 · Publicação no Telegram
• https://wordfence.com/threat-intel/vulnerabilities/id/a4d16ccd-149a-4f70-84b4-59429827baa5?source=cve · Nota
• https://twitter.com/CVEnew/status/2033194305721147621 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-3492 · Nota de Segurança