PT-2026-24658 · Gravity Forms · Gravity Forms

Mikemyers · Published 2026-03-11 · Updated 2026-03-15 · CVE-2026-3492

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Gravity Forms versions prior to 2.9.28.1

Description The Gravity Forms plugin for WordPress is susceptible to Stored Cross-Site Scripting. This is caused by a combination of issues: missing authorization on the create from template API endpoint, which allows any authenticated user to create forms; inadequate input sanitization using sanitize text field(), which allows single quotes; and a lack of output escaping when the form title is displayed in the Form Switcher dropdown, where the title attribute is constructed without esc attr(), and the JavaScript saferHtml utility does not escape quotes. This allows authenticated attackers with Subscriber-level access or higher to inject arbitrary JavaScript that will execute when an Administrator searches within the Form Switcher dropdown in the Form Editor.

Recommendations Update Gravity Forms to version 2.9.28.1 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-3492

Affected Products

Gravity Forms

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-3492 · Security Note
• https://docs.gravityforms.com/gravityforms-change-log · Note
• https://t.me/CVEtracker/47119 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/a4d16ccd-149a-4f70-84b4-59429827baa5?source=cve · Note
• https://twitter.com/CVEnew/status/2033194305721147621 · Twitter Post