An unauthenticated stored cross-site scripting vulnerability in Gravity Forms allows attackers to inject malicious scripts that execute in the context of an administrator session.

This is a stored cross-site scripting vulnerability (CWE-79) residing in the consent field validation logic. Unauthenticated attackers can inject malicious scripts that bypass sanitation filters and execute when an administrator views the entries list.

The exploitation of this vulnerability poses a significant risk to site integrity and administrative account security. By executing arbitrary JavaScript in an administrator's browser, an attacker could potentially perform unauthorized actions, modify form data, or capture session tokens. Given the CVSS score of 7.2, this vulnerability is considered high severity because it enables unauthenticated remote interaction with the administrative interface.

Immediate Action: Review the Gravity Forms official change log and apply the latest security update provided by Rocketgenius immediately. If an update is not yet available for your specific environment, restrict access to administrative entry management pages.

Proactive Monitoring: Monitor WordPress administrative logs for suspicious activity on the Entries List page. Audit entries for unexpected script tags or anomalous characters within consent field labels.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common XSS patterns and malicious script injection attempts targeting hidden form inputs.

Public Exploit Available: No

This vulnerability represents a critical risk to WordPress environments using the Gravity Forms plugin, as it allows unauthenticated attackers to compromise administrative sessions. Administrators should prioritize checking for updates from Rocketgenius and apply the latest patch as soon as it is released to prevent potential exploitation.