CVE-2026-97645

Name of the Vulnerable Software and Affected Versions Gravity Forms versions prior to 3.1.3

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping in the List Field. Unauthenticated attackers can inject arbitrary web scripts into pages. Exploitation happens when an administrator clicks an injected link in the entry detail view and confirms a dialog, which triggers the admin JavaScript bundle's delegated data-dialog-callback handler to execute the attacker-supplied function reference.

Recommendations Update Gravity Forms to version 3.1.3 or later.