EUVD-2026-20131
GHSA-j8cq-gw56-fpqp
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Primary rating from Vendor (Wordfence) · only source for this CVE.
CVSS VectorVendor: Wordfence
Lifecycle Timeline
3DescriptionCVE.org
The Magic Conversation For Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'magic-conversation' shortcode in all versions up to, and including, 3.0.97 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
Stored Cross-Site Scripting (XSS) in Magic Conversation For Gravity Forms plugin allows authenticated attackers with contributor-level access to inject arbitrary JavaScript via unsanitized shortcode attributes, executing malicious scripts in pages viewed by any visitor. The vulnerability affects all versions up to and including 3.0.97 and requires no user interaction from the victim. With an EPSS score context of 6.4 CVSS and confirmed patch availability, this represents a moderate-to-significant risk to WordPress sites with untrusted contributor accounts.
Technical ContextAI
The vulnerability stems from insufficient input sanitization and output escaping in the 'magic-conversation' shortcode handler within the Magic Conversation For Gravity Forms plugin (CPE: cpe:2.3:a:magicplugins:magic_conversation_for_gravity_forms:*:*:*:*:*:*:*:*). The shortcode processor fails to properly escape user-supplied shortcode attributes before rendering them in page output, enabling attackers to inject HTML and JavaScript payloads. This is a classic Stored XSS vulnerability (CWE-79: Improper Neutralization of Input During Web Page Generation), where malicious input persists in the WordPress database as part of page/post content and executes for all subsequent visitors. The root cause involves the WordPress plugin development anti-pattern of directly interpolating untrusted shortcode attributes into the output without using WordPress escaping functions such as esc_attr() or esc_js().
RemediationAI
Update the Magic Conversation For Gravity Forms plugin to version 3.0.98 or later, which includes proper input sanitization and output escaping. Perform the update through the WordPress admin dashboard (Plugins → Installed Plugins → Magic Conversation For Gravity Forms → Update Now) or via WP-CLI with wp plugin update magic-conversation-for-gravity-forms. As a temporary mitigation pending patch deployment, restrict the 'contributor' WordPress role to trusted team members only and audit existing pages/posts for suspicious shortcode attributes. Remove or edit any 'magic-conversation' shortcodes containing unusual characters, JavaScript keywords, or event handlers. See Wordfence vulnerability advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/bc425c4a-cb4e-4f50-b85b-8c4c7778c073?source=cve for additional detection signatures and timeline details.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today