Gravity Forms, a WordPress plugin, contains a stored cross‑site scripting vulnerability that allows unauthenticated users to inject arbitrary JavaScript into the credit card "Card Type" sub‑field. The unsanitized value is stored in the database and rendered unescaped when an administrator views a form entry, enabling the attacker to execute malicious scripts with the administrator’s permissions. The flaw is a classic input validation issue (CWE‑79) that can lead to data theft, session hijacking, or defacement of the backend interface.

The vulnerability affects the Gravity Forms plugin for WordPress in all releases up to and including version 2.9.30. Any WordPress site that has that plugin version installed and uses a credit‑card field in a form is potentially impacted.

The CVSS score of 6.1 indicates medium severity, and the vulnerability can be exploited by sending a crafted POST request containing a malicious value for input_<id>.4 to any form that uses the credit‑card field. The attacker does not need authentication or privileged access, making it a broad threat to sites that implement the affected plugin version. Although this flaw is not listed in the CISA KEV catalog and no EPSS score is available, the possibility of automated exploitation exists, especially if the site exposes a public form entry interface.