CVE-2026-90437 | Gravity Forms Plugin up to 3.1.1 on WordPress Rich-Text Paragraph Fields allow_html data-dialog-confirm cross site scripting

October 30, 2026 Yanac

A vulnerability was found in Gravity Forms Plugin up to 3.1.1 on WordPress and classified as problematic. This affects the function allow_html of the component Rich-Text Paragraph Fields. The manipulation of the argument data-dialog-confirm results in cross site scripting.

This vulnerability is cataloged as CVE-2026-90437. The attack may be launched remotely. There is no exploit available.VulDB Recent EntriesRead More