What is CVE-2026-12477?
The Gravity Booster – Styles & Layouts for Gravity Forms plugin for WordPress is affected by a Stored Cross-Site Scripting (XSS) vulnerability via admin settings due to insufficient input sanitization. This allows authenticated attackers to inject malicious scripts. Versions up to 5.26 are impacted, and updating is recommended.
Azərbaycanca: WordPress üçün "Gravity Booster – Styles & Layouts for Gravity Forms" plaginində admin panel vasitəsilə Stored Cross-Site Scripting (XSS) zəifliyi aşkar edilib. Bu, autentifikasiya olunmuş hücumçulara zərərli skript yerləşdirməyə imkan verir. Plaginin 5.26 və daha əvvəlki versiyalarına təsir edir, yeniləmə tətbiq etmək tövsiyə olunur.
Related CVEs
link basis: same weakness class CWE-79
FAQ2
Which versions of the Gravity Booster plugin are affected by the Stored XSS vulnerability?
Versions 5.26 and earlier of the plugin are vulnerable to this Stored XSS issue.
Is authentication required for an attacker to exploit this vulnerability?
Yes, this vulnerability allows authenticated attackers to inject malicious scripts via the admin panel.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.