Gravity Forms Plugin Stored XSS via Insufficient Input Sanitization

The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Post Excerpt / Post Custom Field / Rich-Text Paragraph Field Values in all versions up to, and including, 3.1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is possible because Post Excerpt, Post Custom Field, and Rich-Text-Editor-enabled Paragraph Text fields allow raw HTML submissions via allow_html(), and an entity-encoded payload stored in a data-dialog-confirm attribute evades wp_kses_post() at save time but is decoded into executable markup by the browser when the plugin's admin JavaScript passes the attribute value to insertAdjacentHTML().

Casky was already ahead

This CVE exploits attack patterns that Casky's 323matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

Gravity Forms, a widely-used WordPress form builder plugin, contains a critical stored cross-site scripting (XSS) vulnerability affecting all versions through 3.1.1. The vulnerability exists in how the plugin handles Post Excerpt, Post Custom Field, and Rich-Text Paragraph field values, failing to properly sanitize user input and escape output. Unauthenticated attackers can inject malicious JavaScript that persists in the database and executes whenever any user accesses pages containing the compromised form data. This affects any WordPress installation using Gravity Forms, potentially impacting thousands of websites and their visitors who may unknowingly execute attacker-controlled scripts in their browsers.

Casky's 323 matched security skills leverage Claude's extended reasoning to detect the attack patterns underlying this vulnerability across the MITRE ATT&CK framework. Practitioners using Casky would identify detection opportunities aligned with TA0001 (Initial Access) and TA0043 (Reconnaissance) techniques—specifically observing suspicious form submissions containing script tags or encoded payloads that bypass sanitization filters, and recognizing the reconnaissance phase where attackers probe Gravity Forms installations for vulnerable versions. The platform's skills enable practitioners to construct detection rules for stored XSS indicators: monitoring database queries for escaped JavaScript in form field values, analyzing HTTP requests for unusual payload patterns in form submissions, and tracking execution anomalies when form data renders in page contexts. By mapping these observations to CWE-79 (Improper Neutralization of Input During Web Page Generation), security teams gain a comprehensive view of the attack chain from initial injection through payload execution, enabling both prevention through input validation and detection through behavioral anomalies.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

323 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-90437.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-90437

Casky has 323 skills that investigate the attack patterns behind CVE-2026-90437. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn