CVE-2026-12477 describes a stored cross-site scripting vulnerability (CWE-79) in the Gravity Booster – Styles & Layouts for Gravity Forms plugin for WordPress. The flaw arises from improper neutralization of input during web page generation, enabling authenticated attackers with editor-level or higher privileges to inject arbitrary web scripts through admin settings. These scripts execute when users access the affected pages. The vulnerability affects all versions up to and including 5.26 and is limited to multi-site WordPress installations or those where unfiltered_html is disabled. The CVSS 3.1 base score is 4.4 (medium severity), reflecting network attack vector, high attack complexity, high privileges required, no user interaction, and partial confidentiality and integrity impact.

An attacker with editor-level or higher permissions can inject persistent malicious scripts into pages via admin settings. These scripts execute in the context of users visiting the injected pages, potentially leading to unauthorized actions or data exposure within the affected WordPress multi-site or restricted installations. The impact is limited to confidentiality and integrity with no availability impact. The vulnerability does not affect single-site installations or those with unfiltered_html enabled.

No official patch or fix is currently documented for this vulnerability. Users should monitor the vendor's advisory channels for updates. Until a fix is available, restrict editor-level permissions carefully and consider limiting multi-site installations or enabling unfiltered_html where appropriate. Avoid granting editor or higher privileges to untrusted users. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.