The Gravity Forms plugin for WordPress contains a Stored Cross-Site Scripting vulnerability that allows unauthenticated attackers to execute malicious scripts in the context of an administrator session.

This vulnerability occurs because the plugin fails to properly sanitize input in Hidden Product fields within Repeater fields, allowing unauthenticated attackers to inject arbitrary JavaScript. When an administrator views the affected entry details, the injected script executes within their browser session.

This vulnerability poses a significant risk to organizational security, as it facilitates the potential compromise of administrative accounts. Successful exploitation could lead to unauthorized actions performed on behalf of an administrator, session hijacking, or the exfiltration of sensitive form data. Given the CVSS score of 7.2, this issue is classified as high severity due to the potential for administrative privilege abuse.

Immediate Action: Update the Gravity Forms plugin to the latest version, ensuring it exceeds 2.10.0, to apply the necessary input validation and output escaping fixes.

Proactive Monitoring: Monitor WordPress administrative access logs for unusual activity or unauthorized changes occurring shortly after form submissions are processed.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block common cross-site scripting patterns in incoming POST requests.

Public Exploit Available: No — there is no confirmed public exploit or proof-of-concept available in the provided data.

The severity of this vulnerability, combined with the potential for administrative account compromise, necessitates immediate action. Security teams should prioritize patching the Gravity Forms plugin across all WordPress instances immediately. If an immediate update is not feasible, administrators should restrict access to entry viewing functions until the patch can be deployed.