Gravity Forms CVE-2026-97645

Injection is possible by unauthenticated users (PR:N) because a List Field value submitted through a public Gravity Forms form is stored without sufficient sanitization or output escaping. However, code execution is strongly gated: an authenticated administrator must open the affected entry in the entry detail view, click the specific attacker-injected link, AND confirm a dialog, which triggers the admin JavaScript bundle's delegated data-dialog-callback handler to invoke the attacker-supplied function reference. These administrator-interaction requirements (viewing the entry, clicking, and confirming) are the primary limiting factors and sharply reduce realistic exploitability versus a no-interaction stored XSS; the flaw affects Gravity Forms versions up to and including 3.1.2.

This is a stored XSS (CWE-79) in Gravity Forms rated CVSS 7.2 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, meaning the injection point is reachable by unauthenticated network attackers (PR:N) against a scope-crossing admin context (S:C). However, the supplied CVSS vector is internally inconsistent with the description: it asserts UI:N, yet the description states that successful exploitation REQUIRES an administrator to view the entry detail, click the attacker-injected link, and confirm a dialog before the admin JavaScript bundle's data-dialog-callback handler fires - that is real, non-trivial user interaction, so the effective risk is lower than the raw 7.2 and UI:N suggest. No EPSS score, no CISA KEV listing, and no proof-of-concept exploit were provided in the input, so there is no evidence of active exploitation or weaponization; the only priority signal is the vuln.today 'this_week' decision label and Wordfence's reporting. Net assessment: a genuine unauthenticated-to-admin stored XSS worth remediating in a normal weekly cycle, but the mandatory multi-step admin interaction and absence of exploitation/EPSS/KEV signals place it below drop-everything urgency. Verify the UI requirement against the Wordfence advisory, since CVSS UI:N contradicts the described click-and-confirm trigger.

An unauthenticated attacker submits a Gravity Forms form containing a malicious payload in a List Field, which is stored and later rendered in the administrator's entry detail view. When an administrator opens that entry, clicks the attacker-injected link, and confirms the resulting dialog, the admin JavaScript bundle's delegated data-dialog-callback handler invokes the attacker-supplied function reference, executing arbitrary script in the admin's authenticated session. No public exploit code was identified in the input, and the attack depends on deliberate administrator interaction despite the network-accessible, low-complexity injection point.