CVE-2026-1396 is a stored cross-site scripting vulnerability in the Magic Conversation For Gravity Forms WordPress plugin. The issue is due to improper neutralization of input during web page generation, specifically insufficient input sanitization and output escaping of user-supplied attributes in the 'magic-conversation' shortcode. This allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts that execute in the context of users viewing the injected pages. The vulnerability affects all versions up to and including 3.0.97. The CVSS 3.1 base score is 6.4, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and impacts on confidentiality and integrity with scope changed.

An attacker with contributor-level or higher privileges can inject persistent malicious scripts into pages using the vulnerable shortcode. These scripts execute in the browsers of users who access the affected pages, potentially leading to unauthorized actions or data disclosure within the context of the affected site. The vulnerability impacts confidentiality and integrity but does not affect availability. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access to trusted users only and consider removing or disabling the 'magic-conversation' shortcode if feasible. Monitor official vendor channels for updates and apply patches promptly once available.