Stored Cross‑Site Scripting in the Magic Conversation For Gravity Forms plugin allows an attacker with contributor or higher privileges to insert arbitrary JavaScript through shortcode attributes. The output does not escape or sanitize user input, which can lead to script execution on pages rendered by any site visitor. This can result in session hijacking, defacement, or other client‑side attacks.

WordPress sites that use the Magic Conversation For Gravity Forms plugin, versions 3.0.0 through 3.0.97. Only plugins up to the listed version are affected; newer releases are presumed patched.

The CVSS v3 score of 6.4 indicates moderate severity. The vulnerability does not have an EPSS score published, and it is not listed in the CISA KEV catalogue. Exploitation requires authenticated access to the WordPress administrative interface with contributor or higher role, and the attacker must supply a malicious shortcode that is later rendered to visitors. Once the malicious code is injected, any visitor who loads the page will execute the script.