Gravity Forms for WordPress is vulnerable to a stored XSS flaw caused by missing authorization on the create_from_template AJAX endpoint, inadequate input sanitization, and unsafe output rendering. This permits an authenticated user with Subscriber or higher privileges to inject malicious JavaScript that runs in the context of an Administrator when searching in the Form Switcher dropdown within the Form Editor. The flaw is classified as CWE‑79. The resultant effect is client‑side execution that could steal session cookies, deface the site, or perform other malicious actions within the scope of an administrator’s session.

All installations of the Gravity Forms plugin for WordPress up to and including version 2.9.28.1 are affected. The vulnerable component is the create_from_template AJAX endpoint and the form title rendering in the Form Switcher dropdown.

The CVSS base score is 6.4, indicating a moderate severity level. The EPSS score is less than 1%, suggesting a low probability of mass exploitation, and the vulnerability is not listed in the CISA KEV catalog. Attackers require valid authentication as a user with Subscriber or higher privileges, so the risk is limited to compromised or poorly secured sites that allow such authenticated access. Given the lack of readily available public exploits and the need for authentication, the immediate risk to public‑facing sites is moderate but non‑negligible.