CVE-2026-90437

Name of the Vulnerable Software and Affected Versions Gravity Forms versions prior to 3.1.2

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting. This occurs because Post Excerpt, Post Custom Field, and Rich-Text-Editor-enabled Paragraph Text fields permit raw HTML submissions through the allow html() function. An entity-encoded payload stored in a data-dialog-confirm attribute can bypass wp kses post() during the save process and is subsequently decoded into executable markup by the browser when the admin JavaScript utilizes the insertAdjacentHTML() function. This enables the execution of arbitrary web scripts when a user accesses an affected page.

Recommendations Update to a version newer than 3.1.1.