CVE-2026-12477 is a stored cross-site scripting vulnerability in the Gravity Booster – Styles & Layouts for Gravity Forms WordPress plugin. The flaw exists due to improper neutralization of input during web page generation, allowing authenticated attackers with editor or higher privileges to inject arbitrary scripts via admin settings. These scripts execute in the context of users visiting the injected pages. The vulnerability affects multi-site WordPress installations and those with unfiltered_html disabled, impacting all plugin versions up to and including 5.26. The CVSS 3.1 base score is 4.4, indicating medium severity, with attack vector network, high attack complexity, requiring privileges, no user interaction, and scope changed.

An attacker with editor-level or higher privileges can inject malicious scripts that execute in the browsers of users who visit the compromised pages. This can lead to limited confidentiality and integrity impacts such as session hijacking or content manipulation. The vulnerability does not affect availability. The scope is changed, meaning the vulnerability affects resources beyond the attacker’s privileges.

No official patch or fix has been confirmed at this time. Administrators should monitor the vendor's advisory for updates and apply any forthcoming patches promptly. Until a fix is available, restrict editor-level permissions to trusted users only and consider disabling multi-site installations or enabling unfiltered_html if feasible. Review and sanitize admin inputs manually where possible to reduce risk.