Gravity Forms CVE-2026-16649

Exploitation requires: (1) Gravity Forms plugin installed at version 2.10.5 or earlier on the target WordPress site; (2) a publicly accessible form that includes a Post Body field accepting user-submitted content; (3) the stored form entry must subsequently be rendered in a page viewed by any user, since the XSS payload executes client-side via the tooltip script's innerHTML re-parsing of aria-label values. No authentication is required to inject the payload (PR:N confirmed by CVSS vector). Execution is limited by the need for a victim to load the affected page (the supplied UI:N metric overstates accessibility - victim page-load is an implicit prerequisite for stored XSS). Sites where form entries are never rendered to users, or where Gravity Forms' tooltip functionality is not active, are not exposed to this specific attack path.

The vendor-supplied CVSS 3.1 score of 7.2 uses the vector AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. The UI:N metric is inconsistent with stored XSS: a victim must load the affected page for the payload to execute, which constitutes user interaction (UI:R by CVSS 3.1 definitions); the more defensible score is approximately 6.1 with UI:R. No EPSS score or KEV listing was provided in the input data, and no public exploit code has been identified at time of analysis. Despite these absent escalation signals, the risk is non-trivial: the attack requires no credentials, the sanitization bypass defeats a control (wp_kses_post) that WordPress site operators commonly treat as sufficient, and Gravity Forms is broadly deployed in SMB and enterprise WordPress environments. Sites where form entries are displayed to administrators or front-end visitors face meaningful risk of session token theft or administrative credential compromise.

An unauthenticated attacker locates a WordPress site running Gravity Forms ≤2.10.5 with a publicly accessible form that includes a Post Body field, then submits an entry containing an aria-label attribute embedding an onerror event handler. The payload passes wp_kses_post validation and is stored in the WordPress database. When an administrator or any front-end visitor loads the page that renders that form entry, the tooltip script injects the aria-label value as innerHTML, triggering the event handler and executing attacker JavaScript in the victim's browser - enabling session cookie theft or administrative credential capture.