CVE-2026-110884

Deferred Deferred - Pending Action

Reflected Cross-Site Scripting in Live Summary for Gravity Forms

Publication date: 2026-10-21

Last updated on: 2026-10-21

Assigner: Patchstack

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in geekontheroad Live Summary for Gravity Forms live-summary-for-gravity-forms allows Reflected XSS.This issue affects Live Summary for Gravity Forms: from n/a through 1.2.10.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-21

Generated

2026-11-10

AI Q&A

2026-10-22

EPSS Evaluated

2026-11-09

NVD

CVE-2026-110884

EUVD

EUVD-2026-107156

Affected Vendors & Products

Vendor	Product	Version / Range
geekontheroad	Live Summary for Gravity Forms	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This is a Reflected Cross-Site Scripting (XSS) vulnerability in the Live Summary for Gravity Forms plugin for WordPress. It allows attackers to inject malicious scripts into web pages viewed by users. The flaw exists due to improper neutralization of user input during web page generation.

Detection Guidance

To detect this vulnerability, check if your WordPress site uses Live Summary for Gravity Forms plugin version 1.2.10 or earlier. Inspect web forms and pages for suspicious input fields that may reflect user-supplied data without proper sanitization. Monitor for unusual script execution or data exfiltration attempts.

Impact Analysis

Attackers can exploit this to steal visitor data, hijack user accounts, or perform actions on behalf of users. Successful exploitation requires a user to interact with a malicious link or crafted page, but it can be used in mass campaigns targeting many websites.

Compliance Impact

This reflected XSS vulnerability could allow attackers to inject malicious scripts into web pages, potentially leading to theft of sensitive user data such as cookies or session tokens. This may violate GDPR requirements for data protection and security, and HIPAA rules for safeguarding protected health information if exploited on healthcare-related forms.

Mitigation Strategies

Immediately update the Live Summary for Gravity Forms plugin to version 1.2.11 or later. If updating is not possible, apply Patchstack's mitigation rule to block attacks until the update is applied. Remove or disable the plugin if unused.

Hi! I’m here to help you understand CVE-2026-110884. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...