The Gravity Forms plugin for WordPress contains a critical Stored Cross-Site Scripting vulnerability that allows unauthenticated attackers to execute arbitrary JavaScript in the context of an administrator session.

The flaw exists because the plugin improperly validates Product Option field values, allowing raw, unsanitized data to be stored in the database. When an administrator views the Order Summary, the malicious script is rendered directly in the browser via view-order-summary.php, enabling unauthenticated remote code execution of scripts.

This vulnerability carries a CVSS score of 7.2, reflecting a significant risk of administrative account compromise. Successful exploitation allows an attacker to hijack administrator sessions, potentially leading to full site takeover, unauthorized data exfiltration, or the injection of malicious content into the WordPress environment.

Immediate Action: Update the Gravity Forms plugin to the latest version available from the vendor, which addresses the improper sanitization and output escaping flaws.

Proactive Monitoring: Review administrative audit logs for unusual entry access patterns or unauthorized modifications to order data.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block malicious script injection attempts targeting common WordPress plugin parameters.

Public Exploit Available: Unknown.

Given the severity of this vulnerability and the potential for complete administrative compromise, all organizations utilizing the Gravity Forms plugin must prioritize patching. Verify the current version of the plugin immediately and apply the latest security update provided by Rocketgenius to eliminate the risk of Stored Cross-Site Scripting.