The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Post Body Field Value in all versions up to, and including,… (CVE-2026-16649)

CVE-2026-16649 is a stored Cross-Site Scripting vulnerability in the Gravity Forms WordPress plugin affecting all versions up to and including 2.10.5. The vulnerability is due to insufficient sanitization and escaping of the Post Body field value, allowing unauthenticated attackers to inject arbitrary web scripts. The sanitization function wp_kses_post allows required HTML tags and attributes, and the client-side tooltip script re-parses the aria-label attribute as innerHTML, stripping only script elements but leaving event-handler attributes intact and executable. This results in persistent XSS that triggers when a user views the injected content.

An unauthenticated attacker can inject persistent malicious scripts into pages rendered by the Gravity Forms plugin. These scripts execute in the context of users visiting the affected pages, potentially leading to information disclosure, session hijacking, or other client-side impacts. The vulnerability does not affect availability but impacts confidentiality and integrity. The CVSS 3.1 base score is 7.2 (High), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and scope change.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting access to vulnerable functionality to mitigate risk. Monitor the vendor's official channels for updates and apply patches promptly once released.