The Gravity Forms plugin for WordPress contains an unauthenticated stored Cross-Site Scripting vulnerability that allows attackers to inject malicious scripts into administrative entry logs.

This flaw exists because the plugin fails to sanitize Calculation Product field names within Repeater fields, allowing unauthenticated attackers to supply arbitrary HTML. When an administrator views these entries, the malicious script executes within the context of the WordPress dashboard.

Successful exploitation allows an unauthenticated attacker to execute arbitrary scripts in the browser of an authenticated administrator. This can lead to unauthorized actions within the WordPress dashboard, session hijacking, or the further compromise of the WordPress environment. With a CVSS score of 7.2, this vulnerability represents a high risk to the integrity and security of administrative operations.

Immediate Action: Monitor the vendor advisory and update the Gravity Forms plugin to the first available version greater than 2.10.0 as soon as it is released.

Proactive Monitoring: Review WordPress audit logs for suspicious form submissions or unexpected changes to entry data.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common XSS payloads in POST requests, which may provide temporary protection while awaiting a patch.

Public Exploit Available: Unknown.

Given the high severity of this unauthenticated XSS vulnerability, administrators should prioritize the installation of the security update as soon as Rocketgenius releases a patched version. Until a fix is available, assess the necessity of public-facing forms using the affected Calculation Product fields and disable them if they are not mission-critical to reduce the attack surface.