Gravity Forms <= 2.9.28.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Form Title

The XSS vulnerability in Gravity Forms arises from a combination of factors. Firstly, the createfromtemplate AJAX endpoint lacks proper authorization checks, enabling any authenticated user to create forms. Secondly, the sanitizetextfield() function fails to adequately sanitize input, allowing single quotes to persist. Finally, the form title, displayed in the Form Switcher dropdown, is not properly escaped when rendered, creating a vulnerable point for script injection. An attacker could leverage this to inject JavaScript code that executes in the context of other users viewing the Form Switcher, potentially stealing session cookies or redirecting users to malicious websites. The blast radius extends to all users who interact with the Form Switcher.

1. Reserviert2026-03-03
2. Veröffentlicht2026-03-11
3. Geändert2026-04-08
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2026-3492 is to immediately upgrade Gravity Forms to version 2.9.29 or later. If upgrading is not immediately feasible due to compatibility issues, consider restricting access to the createfromtemplate endpoint to authorized users only. While not a complete fix, implementing a Web Application Firewall (WAF) rule to filter potentially malicious input in the form title field can provide an additional layer of defense. Regularly review and audit form templates for any suspicious code.