CVE-2026-90437: 
WordPress vulnerability analysis and mitigation

CVE-2026-90437 is a Stored Cross-Site Scripting (XSS) vulnerability in the Gravity Forms plugin for WordPress, affecting all versions up to and including 3.1.1. The flaw allows unauthenticated attackers to inject arbitrary web scripts into pages that execute whenever a user accesses an affected page. It was published on October 30, 2026, with a patch advisory added the same day. The vulnerability carries a CVSS v3.1 base score of 7.2 (High) (GitHub Advisory, Wordfence).

The root cause is insufficient input sanitization and output escaping (CWE-79) in the Post Excerpt, Post Custom Field, and Rich-Text-Editor-enabled Paragraph Text fields. These fields permit raw HTML submissions via the allow_html() function, and an entity-encoded XSS payload stored in a data-dialog-confirm HTML attribute successfully bypasses WordPress's wp_kses_post() sanitization at save time. When the plugin's admin-side JavaScript later retrieves this attribute value and passes it to insertAdjacentHTML(), the browser decodes the entity-encoded payload into executable markup, triggering script execution. No authentication is required, and the attack vector is entirely network-based (GitHub Advisory, Wordfence).

Successful exploitation allows an unauthenticated attacker to persistently inject malicious JavaScript that executes in the browsers of any user — including administrators — who visits an affected page. This can result in session cookie theft, account hijacking, unauthorized actions performed on behalf of legitimate users, and content defacement. Because the injected scripts can target admin-level users, there is potential for privilege escalation and further site compromise (GitHub Advisory, Wordfence).

As of the disclosure date, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation. The NVD SSVC assessment confirms no known exploitation and classifies the technical impact as partial, though the attack is rated as automatable due to the lack of authentication or user interaction requirements. The EPSS score is approximately 0.19%, indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory, Wordfence).

1. Reconnaissance: Identify WordPress sites running Gravity Forms version 3.1.1 or earlier using passive techniques (e.g., checking plugin metadata in page source or using tools like WPScan).
2. Identify vulnerable fields: Locate a publicly accessible form that uses Post Excerpt, Post Custom Field, or a Rich-Text-Editor-enabled Paragraph Text field with allow_html() enabled.
3. Craft entity-encoded payload: Prepare an XSS payload (e.g., <img src=x onerror=alert(document.cookie)>) and HTML-entity-encode it so it bypasses wp_kses_post() sanitization at save time (e.g., <img src=x onerror=alert(document.cookie)>).
4. Inject payload via form submission: Submit the entity-encoded payload into the vulnerable field through a normal form submission — no authentication is required.
5. Payload storage: The entity-encoded payload is stored in the data-dialog-confirm attribute of the rendered HTML without being stripped by wp_kses_post().
6. Trigger execution: When an admin or other user visits the affected page, the plugin's admin JavaScript reads the data-dialog-confirm attribute value and passes it to insertAdjacentHTML(), causing the browser to decode and execute the injected script.
7. Achieve objective: The executed script can exfiltrate session cookies, perform actions as the victim user, or establish persistence (e.g., creating a rogue admin account) (GitHub Advisory, Wordfence).

• Logs: WordPress access logs showing unusual or repeated POST requests to form submission endpoints with HTML-entity-encoded content in field values; entries in the WordPress database (wp_posts or custom Gravity Forms tables) containing entity-encoded script tags or event handler attributes in Post Excerpt or Post Custom Field values.
• File System: Unexpected modifications to WordPress theme or plugin files that could indicate follow-on compromise after session hijacking.
• Network: Outbound requests from admin browsers to unknown external domains shortly after visiting Gravity Forms admin pages, potentially indicating cookie exfiltration.
• Process/Application: JavaScript errors or unexpected insertAdjacentHTML calls logged in browser developer consoles when accessing Gravity Forms admin pages; admin accounts with unexpected privilege changes or new admin users created without authorization (Wordfence).

The primary remediation is to upgrade the Gravity Forms plugin to a version newer than 3.1.1, which contains the fix for this vulnerability (GitHub Advisory). As an interim workaround, administrators should restrict allow_html() permissions for Post Excerpt, Post Custom Field, and Rich-Text Paragraph fields to authenticated, trusted users only. Additionally, site owners should audit existing form entries for signs of injected JavaScript and monitor for suspicious form submissions. Applying a Web Application Firewall (WAF) rule to block entity-encoded script payloads in form inputs can provide additional defense-in-depth (Wordfence).

Wordfence included this vulnerability in their weekly WordPress vulnerability report for the period of October 26–November 1, 2026, highlighting it as part of their ongoing threat intelligence coverage (Wordfence Blog). The vulnerability was also noted on the InfoSec Exchange Mastodon instance shortly after disclosure. No significant broader media coverage or notable researcher commentary beyond standard vulnerability database aggregation has been observed.