The vulnerability in Live Summary for Gravity Forms stems from improper neutralization of user‑supplied input when generating web pages. This flaw enables reflected XSS, allowing an attacker to deliver malicious scripts to authenticated or unauthenticated users who visit a crafted URL or submit a form. The result is client‑side code execution that can hijack sessions, deface content, or gain access to sensitive information within the user’s context.

Affected systems are installations of the WordPress Live Summary for Gravity Forms plugin developed by geekontheroad, version 1.2.10 and earlier. The plugin may be present on any WordPress site utilizing Gravity Forms for live summaries.

The CVSS score of 7.1 indicates a high severity for this reflected XSS. No EPSS data is available, and the vulnerability has not yet been reported in the CISA KEV catalog. Attackers can exploit the flaw by directing users to a specially crafted link or by manipulating form fields. Because the flaw is client‑side, no privileged execution on the server is required. The required conditions are simply a user browsing a vulnerable site with a susceptible plugin version.