CVE-2026-84293: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in addonsorg Repeater Fields for Gravity Forms

CVE-2026-84293 describes a stored cross-site scripting vulnerability (CWE-79) in the Repeater Fields for Gravity Forms plugin for WordPress. The flaw exists in repeated multi-input sub-field types (e.g., Name, Address, Checkbox) due to inadequate sanitization and escaping of user input before output. This enables unauthenticated attackers to inject arbitrary web scripts that execute in the context of users viewing the injected pages. The vulnerability affects all versions up to and including 3.0.4. Scalar single-input fields are escaped with esc_html() in version 3.0.4, but this protection does not extend to multi-input sub-fields. No patch or official remediation is currently documented.

An unauthenticated attacker can exploit this vulnerability to perform stored cross-site scripting attacks, potentially leading to the execution of arbitrary scripts in the context of users visiting affected pages. This can result in information disclosure or user session compromise. The CVSS score of 7.2 (high) reflects the network attack vector, low attack complexity, no privileges required, no user interaction, and partial impact on confidentiality and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or limiting the use of repeated multi-input sub-fields in the plugin or applying custom input sanitization and output escaping as a temporary measure. Monitor the vendor's communications for updates on patches or official mitigations.