Gravity Forms <= 3.1.2 - Unauthenticated Stored Cross-Site Scripting via List Field

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via List Field in all versions up to, and including, 3.1.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires the administrator to click the injected link in the entry detail view and confirm a dialog, which triggers the admin JavaScript bundle's delegated data-dialog-callback handler to invoke the attacker-supplied function reference.

Etkilenen sürümler1 yazılım

Kaynaklar4 kaynak

• CVE.org kaydı
• NVD kaydı
• wordfence.com/…lities/id/9889e718-381b-4d11-a234-0278037c61c4 Diğer
• docs.gravityforms.com Diğer

Kayıt geçmişi

1. 30 Eki 2026 09:47Yayımlandı

İlgili açıklar

• 9,8 CVE-2026-103039Gravity Forms <= 3.1.2 - Unauthenticated PHP Object Injection via Post Custom Field
• 7,2 CVE-2026-90437Gravity Forms <= 3.1.1 - Unauthenticated Stored Cross-Site Scripting via Post Excerpt / Post Custom Field / Rich-Text Paragraph Field Values
• 5,1 CVE-2025-68395Stored XSS in Protectel
• 5,4 CVE-2026-119563phpMyAdmin through 5.2.3 Stored XSS via Designer Query History Table Name
• 7,2 CVE-2026-116622Food Store <= 1.5.5 - Unauthenticated Stored Cross-Site Scripting via 'service_time' Cookie
• 6,4 CVE-2026-118634Events Made Easy <= 3.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'width' Shortcode Attribute