CVE-2026-12477 | BDVDB-2026-360308 Detail
wpmonksGravity Booster – Styles & Layouts for Gravity Forms
Description#
The Gravity Booster – Styles & Layouts for Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 5.26 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Impact#
Per CVSS v3.1: confidentiality impact low, integrity impact low, availability impact none. Attack vector: network.
Weaknesses#
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
References#
- https://www.wordfence.com/threat-intel/vulnerabilities/id/413e5515-6cc9-4fa9-908e-2dc68778f5cb?source=cve
- https://plugins.trac.wordpress.org/browser/styles-and-layouts-for-gravity-forms/tags/5.26/display/class-styles.php#L76
- https://plugins.trac.wordpress.org/browser/styles-and-layouts-for-gravity-forms/tags/5.26/display/class-styles.php#L147
- https://plugins.trac.wordpress.org/browser/styles-and-layouts-for-gravity-forms/tags/5.26/display/class-styles.php#L148
- https://plugins.trac.wordpress.org/browser/styles-and-layouts-for-gravity-forms/tags/5.26/includes/admin/fetch/stla-admin-fetch-content-area.php#L290
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3637650%40styles-and-layouts-for-gravity-forms&new=3637650%40styles-and-layouts-for-gravity-forms
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.