CVE-2026-1396: Magic Conversation For Gravity Forms XSS

CVE-2026-1396 Overview

CVE-2026-1396 is a Stored Cross-Site Scripting (XSS) vulnerability in the Magic Conversation For Gravity Forms plugin for WordPress. The flaw affects all plugin versions up to and including 3.0.97. The issue resides in the magic-conversation shortcode, which fails to properly sanitize input and escape output on user-supplied attributes. Authenticated users with contributor-level access or higher can inject arbitrary JavaScript that executes when visitors load the affected page. The vulnerability is tracked under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Authenticated contributors can store malicious scripts that execute in the browsers of administrators and site visitors, enabling session theft, account takeover, and unauthorized actions in the WordPress admin context.

Affected Products

Magic Conversation For Gravity Forms plugin for WordPress (all versions ≤ 3.0.97)
WordPress sites using the vulnerable magic-conversation shortcode
Patched in plugin version 3.0.98 (changeset 3482359)

Discovery Timeline

2026-04-08 - CVE-2026-1396 published to NVD
2026-04-24 - Last updated in NVD database

Technical Details for CVE-2026-1396

Vulnerability Analysis

The vulnerability exists in main.php of the Magic Conversation For Gravity Forms plugin, around line 1627 of the shortcode handler. The magic-conversation shortcode accepts user-supplied attributes and renders them directly into HTML output without applying WordPress sanitization functions such as esc_attr(), esc_html(), or wp_kses(). An authenticated attacker with contributor permissions can embed the shortcode in a post or page and pass attribute values containing JavaScript payloads. When any user views the rendered page, the browser parses and executes the injected script in the site's origin.

The scope-changed nature of the issue means injected scripts can affect users in security contexts other than the attacker's, including administrators previewing or moderating contributor submissions. Successful exploitation can lead to session hijacking, privilege escalation through forced admin actions, redirection to attacker-controlled domains, or distribution of malware to site visitors.

Root Cause

The root cause is missing input validation and missing output escaping in the shortcode attribute handler. The plugin trusts shortcode attributes supplied by post authors and concatenates them into HTML markup without context-aware encoding. WordPress shortcode APIs do not automatically escape attributes, requiring plugin developers to call sanitization functions explicitly.

Attack Vector

Exploitation requires an authenticated contributor-level account on the target WordPress site. The attacker creates or edits a post containing the magic-conversation shortcode with a crafted attribute value that breaks out of the intended HTML context and introduces a <script> tag or event handler. Once the post is published, previewed, or moderated, the payload executes in the browser of any user accessing it. See the Wordfence Vulnerability Analysis and the WordPress Plugin Source Code for the vulnerable code path.

Detection Methods for CVE-2026-1396

Indicators of Compromise

Posts or pages containing [magic-conversation ...] shortcodes with attribute values that include <script>, javascript:, onerror=, onload=, or other event handlers
Unexpected outbound requests from visitor browsers to unfamiliar domains after loading pages with the shortcode
New or modified administrator accounts created shortly after contributor-authored content is published or previewed
Browser console errors or Content Security Policy (CSP) violations originating from rendered shortcode output

Detection Strategies

Query the wp_posts table for post_content entries containing the magic-conversation shortcode and inspect attribute values for HTML control characters or script keywords
Deploy WordPress security plugins or web application firewall (WAF) rules that flag stored XSS patterns in shortcode parameters
Review WordPress audit logs for contributor accounts publishing or editing content that includes the affected shortcode

Monitoring Recommendations

Monitor authentication logs for contributor and author account creation, especially accounts that immediately author posts using shortcodes
Enable Content Security Policy headers to surface inline script execution attempts in browser reports
Alert on changes to plugin files under wp-content/plugins/magic-conversation-for-gravity-forms/ outside of scheduled update windows

How to Mitigate CVE-2026-1396

Immediate Actions Required

Update the Magic Conversation For Gravity Forms plugin to version 3.0.98 or later, which contains the fix in changeset 3482359
Audit existing posts and pages for the magic-conversation shortcode and review attribute values for malicious content
Review all contributor, author, and editor accounts and remove any that are unfamiliar or unused
Force a password reset for privileged accounts if the vulnerability may have been exploited

Patch Information

The vendor addressed the vulnerability in plugin version 3.0.98 by adding proper sanitization and output escaping to the magic-conversation shortcode attribute handler in main.php. The patch is published in WordPress Plugin Changeset #3482359. Administrators should apply the update through the WordPress admin Plugins page or via WP-CLI.

Workarounds

Deactivate the Magic Conversation For Gravity Forms plugin until the patch is applied if immediate updating is not possible
Restrict contributor-level account creation and require administrator review before publishing contributor content
Deploy a web application firewall rule that blocks shortcode attributes containing <, >, or javascript: substrings
Apply a strict Content Security Policy that disallows inline scripts to limit the impact of injected payloads

bash

# Update the plugin using WP-CLI
wp plugin update magic-conversation-for-gravity-forms

# Verify the installed version
wp plugin get magic-conversation-for-gravity-forms --field=version

# Temporary workaround: deactivate the plugin until patched
wp plugin deactivate magic-conversation-for-gravity-forms