CVE-2026-16649

CVE-2026-16649 is a stored cross-site scripting (CWE-79) vulnerability in the Gravity Forms plugin for WordPress, affecting all versions up to and including 2.10.5, caused by insufficient input sanitization and output escaping of the Post Body Field Value. An unauthenticated attacker can submit crafted content that survives the save-time wp_kses_post sanitization because that filter permits the required HTML tags and attributes; when the stored value is later rendered, the client-side tooltip script re-parses the browser-decoded aria-label value as innerHTML and strips only script elements, leaving onerror and other event-handler attributes intact and executable. As a result, arbitrary web scripts run in the browser of anyone who accesses an injected page, letting the attacker act as that user on the site; the flaw is scored 7.2 (High) with low confidentiality and integrity impact and a changed scope. Any WordPress site running Gravity Forms 2.10.5 or earlier is affected, with practical risk concentrated on sites that display submitted form values on pages visited by other users. No exploitation is currently known: there is no public proof of concept, the issue is not in CISA KEV, and EPSS assigns only about a 0.2% probability of exploitation within 30 days (9th percentile), indicating low near-term risk.

What to do: Update Gravity Forms to the latest release (any version after 2.10.5) on all affected WordPress sites. Until patched, avoid rendering unauthenticated submissions' Post Body values to visitors, or strip event-handler attributes such as onerror from stored values, since the client-side tooltip script executes them. Also review stored entries and any pages that display submissions for unexpected HTML or aria-label payloads.