Gravity Forms CVE-2026-90437

Exploitation requires a publicly accessible Gravity Forms form (version ≤ 3.1.1) that uses one of the specific vulnerable field types - a Post Excerpt field, a Post Custom Field, or a Paragraph Text field with the Rich Text Editor enabled - because these invoke allow_html() and accept raw HTML submissions. The attacker stores an entity-encoded payload in a data-dialog-confirm attribute. Script execution is not immediate: it fires only when a user/administrator subsequently accesses the injected page/entry and the plugin's admin JavaScript decodes the attribute through insertAdjacentHTML(). Limiting factors: a form must actually employ one of these field types with HTML allowed, and a victim must view the stored entry for the payload to trigger - so sites without these field configurations are not exposed.

This is a genuine but mid-tier priority. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, base 7.2 High) indicates a network-reachable, low-complexity, unauthenticated flaw with a scope change - consistent with stored XSS submitted through a public WordPress form and executing in the privileged admin context when an entry is viewed. The impact is bounded (C:L/I:L/A:N), reflecting script execution rather than direct server compromise. The vuln.today decision label is 'this_week' (not 'act_now'/'emergency'), signalling prompt-but-not-emergency remediation. KEV status is not set (no confirmed active exploitation), no EPSS score is provided (exploitation probability cannot be quantified from this data), and no public exploit or PoC reference is present - so this is 'no public exploit identified at time of analysis.' One tension worth flagging: the vector is scored UI:N, yet the description states execution occurs only when a user/administrator accesses the injected page and the plugin's admin JavaScript processes the attribute - a victim-view step that practically constrains exploitation even though it is scored as no attacker-side interaction. Overall: a real, credible issue reported by Wordfence that warrants timely patching, not a drop-everything emergency.

An unauthenticated attacker submits a public Gravity Forms form that uses a Post Excerpt, Post Custom Field, or Rich-Text-enabled Paragraph Text field, embedding an entity-encoded script inside a data-dialog-confirm attribute. The encoded payload passes wp_kses_post() at save time, then executes when an administrator views the stored entry and the plugin's admin JavaScript decodes it via insertAdjacentHTML(), running script in the admin's authenticated browser session. No public exploit or PoC reference is present in the available data.