A critical unauthenticated stored cross-site scripting vulnerability in the Gravity Forms plugin for WordPress allows remote attackers to execute arbitrary JavaScript in the context of an administrator session.

This vulnerability occurs because the plugin fails to properly sanitize input in the SingleProduct field when nested within a Repeater field. An unauthenticated attacker can inject malicious scripts into the product name field, which then execute when an administrator views the submission in the WordPress dashboard.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browser of an administrator. This can lead to full site compromise, unauthorized administrative actions, or the theft of sensitive session tokens. With a CVSS score of 7.2, this vulnerability represents a significant risk to organizational web assets and data integrity.

Immediate Action: Update the Gravity Forms plugin to the latest available version that contains the security patch.

Proactive Monitoring: Monitor WordPress administrative access logs for unusual login patterns or modifications to site configuration files.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets to detect and block malicious script injection attempts targeting common WordPress plugin endpoints.

Public Exploit Available: No (exploit_available: unknown)

Given the high risk of administrative session hijacking, all users of the Gravity Forms plugin must prioritize updating to the patched release. Organizations should verify their current version of Gravity Forms immediately and apply the necessary security updates to prevent potential unauthorized access to their WordPress administrative environment.