The Gravity Booster – Styles & Layouts for Gravity Forms plugin suffers from a stored XSS flaw via the "stylerSettings" parameter. The plugin does not properly sanitize or escape data saved through its admin interface, enabling users with editor-level or higher permissions to embed malicious scripts. Once injected, the script executes whenever a page containing the settings is viewed, potentially allowing the attacker to steal sessions, deface content, or conduct phishing attacks within that site.

All instances of the Gravity Booster plugin up to and including version 5.26, specifically on multi-site WordPress installations where the unfiltered_html capability is disabled, are affected. Affected users include anyone with editor, author, or higher role who can modify the plugin’s settings.

The CVSS score of 4.4 indicates moderate severity; the EPSS score is unavailable and the vulnerability is not currently listed in the CISA KEV catalog. The flaw can be exploited by an authenticated user with sufficient privileges, so the attack vector is application-based through the plugin’s admin panel. The risk is limited to sites where the vulnerability context applies, but successful exploitation grants the attacker the ability to run arbitrary client-side code during page loads.