Gravity Booster Styles Layouts For Gravity Forms
Monthly
Stored Cross-Site Scripting in the Gravity Booster - Styles & Layouts for Gravity Forms WordPress plugin (versions ≤ 5.26) allows authenticated attackers with editor-level permissions to inject persistent malicious scripts into admin settings fields. The injected payload executes in the browser of any user who subsequently visits an affected page, enabling session hijacking, credential theft, or further privilege escalation within the WordPress environment. Exploitation is constrained to multi-site WordPress installations or single-site deployments where the unfiltered_html capability has been explicitly disabled; no public exploit or CISA KEV listing has been identified at time of analysis.
Stored Cross-Site Scripting in the Gravity Booster - Styles & Layouts for Gravity Forms WordPress plugin (versions ≤ 5.26) allows authenticated attackers with editor-level permissions to inject persistent malicious scripts into admin settings fields. The injected payload executes in the browser of any user who subsequently visits an affected page, enabling session hijacking, credential theft, or further privilege escalation within the WordPress environment. Exploitation is constrained to multi-site WordPress installations or single-site deployments where the unfiltered_html capability has been explicitly disabled; no public exploit or CISA KEV listing has been identified at time of analysis.