The Gravity Forms WordPress plugin is vulnerable to stored cross‑site scripting in versions up to and including 2.10.0 because it fails to properly sanitize and escape Product Option field values. An attacker can submit a malicious script that is saved in the database, and when an administrator opens the entry details page the injected JavaScript executes in the administrator’s browser.

Gravity Forms plugin for WordPress, versions 2.10.0 and earlier. Any installation of the affected plugin that contains a Product Option field is susceptible.

The CVSS score of 7.2 indicates high severity. The vulnerability can be exploited by any unauthenticated user who can submit a form containing a malicious Product Option. The attacker need only interact with the public site; no special environment or additional privileges are required. Because the vulnerability is not listed in the CISA KEV catalogue and no exploit has been publicly disclosed, the likelihood of exploitation is uncertain, but the high severity and ease of exploitation warrant prompt attention.