CVE-2026-3492: XSS in Gravity Forms WordPress Plugin

Successful exploitation of CVE-2026-3492 allows an attacker to execute arbitrary JavaScript code within the context of another user's browser session. This can lead to account takeover, data theft (including sensitive information entered into forms), and defacement of the WordPress site. The vulnerability stems from a combination of factors: unauthorized form creation via the createfromtemplate endpoint, insufficient sanitization of form titles, and a lack of proper output escaping when rendering the form title in the Form Switcher dropdown. An attacker could craft a malicious form template that, when created by an authenticated user, would inject a script that steals cookies or redirects users to a phishing site.

1. Reserved2026-03-03
2. Published2026-03-11
3. Modified2026-04-08
4. EPSS updated2026-03-23

The primary mitigation for CVE-2026-3492 is to upgrade Gravity Forms to version 2.9.29 or later. If immediate upgrading is not possible, consider implementing temporary workarounds. Restrict access to the createfromtemplate AJAX endpoint to authorized users only. Implement stricter input validation and sanitization on all user-supplied data, particularly form titles. Consider using a Web Application Firewall (WAF) with XSS filtering rules to block malicious requests. Review existing Gravity Forms configurations for any unusual or suspicious form templates.