CVE-2026-84293

Name of the Vulnerable Software and Affected Versions Repeater Fields for Gravity Forms versions prior to 3.0.5

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on a target server. This issue specifically affects multi-input sub-field types within a repeater, such as Name, Address, and Checkbox fields. Attackers can inject arbitrary web scripts into pages that execute when a user accesses the affected page.

Recommendations Update Repeater Fields for Gravity Forms to version 3.0.5 or later.