What is the CVSS score of CVE-2026-3492?

CVE-2026-3492 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-3492?

Organizations using for WordPress is vulnerable to Stored Cross-Site Scripting in all should be aware of moderate risk from CVE-2026-3492, a cross-site scripting vulnerability rated CVSS 6.4.

How to fix or mitigate CVE-2026-3492?

Within 30 days: Identify affected systems running for WordPress is vulnerable to Stored Cross-Site Scripting i and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

WordPress CVE-2026-3492

MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-03-11 security@wordfence.com

WordPress XSS

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 11, 2026 - 10:16 nvd

MEDIUM 6.4

DescriptionCVE.org

The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.9.28.1. This is due to a compound failure involving missing authorization on the create_from_template AJAX endpoint (allowing any authenticated user to create forms), insufficient input sanitization (sanitize_text_field() preserves single quotes), and missing output escaping when the form title is rendered in the Form Switcher dropdown (title attribute constructed without esc_attr(), and JavaScript saferHtml utility only escapes &, <, > but not quotes). This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary JavaScript that executes when an Administrator searches in the Form Switcher dropdown in the Form Editor.

AnalysisAI

Stored XSS in Gravity Forms WordPress plugin through version 2.9.28.1 allows authenticated subscribers and above to inject malicious JavaScript via the form creation endpoint, which executes when administrators interact with the Form Switcher dropdown. The vulnerability stems from inadequate input sanitization and missing output escaping in the form title field. No patch is currently available.

Technical ContextAI

Classified as CWE-79 (Cross-site Scripting (XSS)). Affects Gravity Forms (WordPress plugin). The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.9.28.1. This is due to a compound failure involving missing authorization on the create_from_template AJAX endpoint (allowing any authenticated user to create forms), insufficient input sanitization (sanitize_text_field() preserves single quotes), and missing output escaping when the form title is rendered in the Form Switcher dropdown (title attribute constructed wit

Affected ProductsAI

Vendor: WordPress. Product: Gravity Forms (WordPress plugin).

RemediationAI

Monitor vendor advisories for a patch. Implement output encoding and Content Security Policy headers. Restrict network access to the affected service where possible.