The vulnerability is an Improper Neutralization of Input During Web Page Generation flaw that allows attackers to inject malicious scripts into pages rendered by the WordPress Import Excel to Gravity Forms plugin. An attacker can craft a URL containing embedded JavaScript or other executable code; when a susceptible user visits that URL, the script runs in the victim’s browser, enabling attacks such as session hijacking, defacement, or malicious redirects. The weakness is classified as CWE‑79, and the vulnerability is reflected, meaning the attacker must provide input that is immediately echoed back to the victim.

The issue affects the wpgear Import Excel to Gravity Forms plugin. All released versions up to and including 1.18 are vulnerable. System owners using this plugin via WordPress should identify the installed version and verify whether it falls within the affected range.

The CVSS score of 7.1 signals a high impact if exploited. However, the EPSS score is less than 1 % and the vulnerability is not listed in the CISA KEV catalog, indicating a low probability of widespread exploitation at present. Attackers would need to get a target to load a crafted request, typically through social engineering or spear‑phishing. Once the request is served, the reflected XSS can fully compromise the victim’s browser session.