CVE-2025-68863
Reflected XSS in iContact for Gravity Forms
Publication date: 2026-02-20
Last updated on: 2026-02-23
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| zack_katz | gravity_forms_icontact | to 1.3.2 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
CVE-2025-68863 is a reflected Cross Site Scripting (XSS) vulnerability affecting the iContact for Gravity Forms WordPress plugin up to version 1.3.2. Detection involves identifying attempts to inject malicious scripts via crafted URLs, form submissions, or page visits.
Since this vulnerability requires user interaction with malicious payloads, monitoring web server logs for suspicious query parameters or POST data containing script tags or encoded payloads can help detect exploitation attempts.
Specific commands are not provided in the available resources, but common approaches include using web application firewall (WAF) logs, intrusion detection systems (IDS), or manual inspection of HTTP requests for suspicious input patterns targeting the vulnerable plugin.
What immediate steps should I take to mitigate this vulnerability?
No official patch is currently available for CVE-2025-68863. However, Patchstack has issued a mitigation rule to block attacks targeting this vulnerability.
Immediate steps include applying the Patchstack mitigation rule to proactively protect your site from exploitation until an official patch is released.
Additionally, consider restricting access to the vulnerable plugin features, monitoring for suspicious activity, and educating users about avoiding clicking on untrusted links or submitting untrusted forms.
Can you explain this vulnerability to me?
CVE-2025-68863 is a medium priority Cross Site Scripting (XSS) vulnerability affecting the WordPress iContact for Gravity Forms Plugin versions up to and including 1.3.2.
This vulnerability allows an unauthenticated attacker to inject malicious scripts—such as redirects, advertisements, or other HTML payloads—into a website, which execute when visitors access the compromised site.
Exploitation requires user interaction by a privileged user, such as clicking a malicious link, visiting a crafted page, or submitting a form.
The vulnerability is classified under OWASP Top 10 A3: Injection.
How can this vulnerability impact me? :
This vulnerability can allow attackers to execute malicious scripts on your website, which may lead to unauthorized redirects, display of unwanted advertisements, or execution of harmful HTML payloads.
Such exploitation can compromise the integrity and trustworthiness of your website, potentially harming your users and damaging your reputation.
Because the attack requires user interaction, users might be tricked into clicking malicious links or submitting crafted forms, leading to further compromise.