An attacker can embed malicious script tags into the form_ids parameter of the gform_get_config AJAX endpoint. Because the JSON response is served with a text/html content type and the JSON encoder does not escape angle brackets, the browser interprets the injected tags and executes the script. This reflected XSS flaw (CWE‑79) allows unauthenticated users to trick anyone visiting a Gravity Forms page into running arbitrary JavaScript, potentially defacing the page or exfiltrating data.

All installations of Gravity Forms version 2.9.30 or earlier on WordPress sites are affected. The plugin exposes the AJAX action on any page that renders a form, and the client‑side nonce is identical across users, giving the flaw access to every unauthenticated visitor.

With a CVSS score of 4.7 the vulnerability is of moderate severity, largely due to its limited scope and the need for user interaction. EPSS data is unavailable and the flaw is not catalogued by CISA, indicating limited public exploitation to date. Attackers can craft a malicious link that triggers the vulnerable AJAX call, and because the response is not properly escaped once the user clicks, exploitation becomes trivial provided the user follows the link. The overall risk remains moderate but is still actionable.