CVE-2026-84293

Repeater Fields for Gravity Forms, a WordPress plugin, contains a stored cross-site scripting flaw caused by insufficient input sanitization and output escaping of repeated multi-input sub-field values. An unauthenticated attacker can submit a form entry with malicious web scripts inside multi-input repeater sub-fields (such as Name, Address, and Checkbox), and the injected script then executes in the browser of any user who views a page displaying that content. Successful exploitation allows arbitrary web script execution in the context of the affected site, which can enable session hijacking, unwanted redirects, or administrative actions on behalf of logged-in users. Any WordPress site running the plugin in all versions through 3.0.4 is affected, with the practical impact limited to sites whose forms use repeaters with multi-input sub-fields and whose submitted values are rendered on site pages; in version 3.0.4, scalar single-input fields are already escaped with esc_html(), so only multi-input sub-fields remain exploitable. There is currently no public proof-of-concept and no confirmed exploitation in the wild, and the issue is not listed in CISA KEV.

What to do: Update the Repeater Fields for Gravity Forms plugin to the latest release (newer than 3.0.4) as soon as a patched version is available, and verify the plugin version in the WordPress admin. Until patching, review Gravity Forms entries and any public pages that render repeater multi-input sub-fields (Name, Address, Checkbox) for injected script tags, and consider restricting or moderating unauthenticated form submissions. Confirm whether your forms actually use repeaters with multi-input sub-fields, since single-input field values are already escaped in version 3.0.4.