Live Summary CVE-2026-110884

Exploitation requires an attacker to deliver a crafted link or request to a victim and have that victim interact with it (CVSS UI:R) - reflected XSS is not self-triggering, so there is no persistent or drive-by component. The vulnerable code path is in the Live Summary for Gravity Forms plugin (versions n/a through 1.2.10), meaning the site must have this specific plugin installed and active, alongside Gravity Forms. No attacker authentication is needed (PR:N). Realistic impact is highest when the tricked victim is an authenticated administrator, since the injected script runs with that user's privileges; limiting factors are the mandatory user interaction, the narrow plugin install base, and the fact that impact is confined to the victim's browser rather than direct server compromise.

This is a moderate-risk reflected XSS (CWE-79) in a niche WordPress add-on. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, 7.1 HIGH) indicates a network-reachable, low-complexity flaw requiring no attacker privileges but DOES require victim user interaction (UI:R) - the elevated 7.1 score is driven largely by the scope change (S:C), which for reflected XSS reflects code executing in the victim's browser context rather than a server compromise. No EPSS score, KEV listing, or POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The low impact sub-scores (C:L/I:L/A:L) and the UI:R requirement substantially temper real-world risk: an attacker cannot compromise the site directly but must socially engineer a victim (ideally an authenticated admin) into clicking a crafted link. Overall this is a 'high-CVSS but bounded-real-risk' issue typical of Patchstack-reported WordPress plugin XSS - a legitimate patch priority for sites running this specific plugin, but not a mass-exploitation emergency. No signals conflict; the main gap is the absence of EPSS/KEV/POC data to further gauge exploitation likelihood.

An attacker crafts a malicious URL pointing at a vulnerable site where user-controlled input is reflected unsanitized into a Live Summary for Gravity Forms page, then phishes a logged-in WordPress administrator into clicking it. When the victim opens the link, injected JavaScript executes in their browser session, enabling actions such as stealing session cookies or performing admin actions via the victim's authenticated context. No public proof-of-concept was provided in the input.