CVE-2026-84293: Gravity Forms Repeater Fields XSS Vulnerability

CVE-2026-84293 Overview

CVE-2026-84293 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the Repeater Fields for Gravity Forms plugin for WordPress. The flaw affects all plugin versions up to and including 3.0.4. Unauthenticated attackers can inject arbitrary JavaScript through repeated multi-input sub-field values, such as Name, Address, and Checkbox fields inside a repeater. The plugin fails to sanitize input and escape output for these sub-field types, while scalar single-input fields are correctly escaped with esc_html() at output. Injected scripts execute when any user views a page containing the malicious repeater content.

Critical Impact
Unauthenticated attackers can persistently inject JavaScript into WordPress pages, enabling session theft, account takeover, and administrative privilege abuse when administrators view affected pages.

Affected Products

Repeater Fields for Gravity Forms plugin for WordPress — all versions through 3.0.4
WordPress sites using Gravity Forms with the Repeater Fields add-on
Forms containing multi-input sub-fields such as Name, Address, and Checkbox inside a repeater

Discovery Timeline

2026-09-09 - CVE-2026-84293 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-84293

Vulnerability Analysis

The vulnerability resides in repeater_field.php within the Repeater Fields for Gravity Forms plugin. The plugin renders repeater sub-field values back into HTML output without applying context-appropriate escaping to multi-input sub-fields. Scalar single-input values pass through esc_html(), but composite field types such as Name, Address, and Checkbox bypass this control. Attackers submit a form containing crafted payloads in these sub-field inputs. The payload is stored in the form entry and later rendered verbatim into pages that display submitted data. Because submission does not require authentication, any unauthenticated user can plant the payload. When a site administrator or another visitor loads the affected page, the injected script executes in the browser context of the WordPress origin.

Root Cause

The root cause is insufficient input sanitization on submission combined with missing output escaping for multi-input sub-field values [CWE-79]. Developers applied esc_html() only to scalar sub-fields in version 3.0.4, leaving composite structures unescaped. Field-level rendering logic at lines 401, 474, 543, and 549 of repeater_field.php returns sub-field values without HTML-encoding them for the specific field types affected.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction beyond visiting an affected page. An attacker crafts a form submission with JavaScript payloads embedded in a multi-input sub-field of a repeater, such as the first-name component of a Name field. The stored payload activates on any page that renders the submitted entry, resulting in a scope change from attacker-controlled input to victim browser execution within the trusted WordPress origin.

No verified proof-of-concept code is available. Technical references are published in the Wordfence Vulnerability Report and the WordPress plugin changeset.

Detection Methods for CVE-2026-84293

Indicators of Compromise

Form entries containing <script>, onerror=, onload=, or javascript: strings inside Name, Address, or Checkbox sub-fields of a repeater.
Unexpected outbound requests from administrator browsers to attacker-controlled domains after viewing entry pages.
New or modified WordPress administrator accounts created shortly after entry submissions from unauthenticated visitors.
HTML source of rendered entry pages containing unescaped angle brackets or event handler attributes within repeater output.

Detection Strategies

Query the WordPress database wp_gf_entry_meta and related tables for repeater sub-field values containing HTML tags or JavaScript event handlers.
Deploy a Web Application Firewall (WAF) rule to inspect Gravity Forms POST bodies for script payloads in repeater sub-field parameters.
Review web server access logs for POST requests to Gravity Forms submission endpoints from unauthenticated sources followed by administrator page views.
Enable Content Security Policy (CSP) reporting to surface inline script execution on pages that render form entries.

Monitoring Recommendations

Monitor the plugin version reported by WordPress site health to confirm all sites are running a patched release above 3.0.4.
Track creation of privileged WordPress user accounts and changes to wp_options and wp_users tables.
Alert on browser-side JavaScript errors originating from entry display pages, which can indicate injected payloads.

How to Mitigate CVE-2026-84293

Immediate Actions Required

Update the Repeater Fields for Gravity Forms plugin to the version released after 3.0.4 that addresses this issue.
Audit existing form entries for stored payloads and delete or sanitize any entries containing scripts in repeater sub-fields.
Rotate credentials and session tokens for administrators who may have viewed pages rendering unsanitized repeater entries.
Restrict public-facing forms that use repeater multi-input sub-fields until the patch is applied.

Patch Information

The vendor addressed the issue in a release following 3.0.4. Review the WordPress plugin changeset for the specific code changes applied to repeater_field.php. Administrators should update through the WordPress plugin dashboard or WP-CLI as soon as the fixed version is available.

Workarounds

Temporarily disable the Repeater Fields for Gravity Forms plugin on sites that expose forms to unauthenticated users.
Remove multi-input sub-field types (Name, Address, Checkbox) from repeaters in published forms until the patch is deployed.
Configure a WAF rule to block form submissions containing <script, on\w+=, or javascript: patterns in Gravity Forms parameters.
Apply a strict Content Security Policy that disallows inline scripts on pages rendering form entries.

bash

# Configuration example: update plugin via WP-CLI once patch is available
wp plugin update repeater-for-gravity-forms
wp plugin get repeater-for-gravity-forms --field=version