Gravity Forms plugin for WordPress contains a stored cross‑site scripting vulnerability that allows an unauthenticated attacker to inject arbitrary HTML and JavaScript into the product name field of a SingleProduct field when it is nested inside a Repeater field. The input is saved to the database without sanitization and is later rendered unescaped when an administrator views the entry. This can lead to the execution of attacker‑controlled scripts in the context of the administrator’s browser, enabling credential theft, defacement, or further exploitation of the site. The weakness is a failure of input validation and output escaping (CWE‑79).

Affected are installations of Gravity Forms version 2.10.0 or earlier running on WordPress. The vulnerability specifically targets the SingleProduct field used within a Repeater component; all forms configured with this field construct are at risk. Upgrading to any version newer than 2.10.0 removes the flaw.

The CVSS score of 7.2 indicates a high severity with medium scope. EPSS data is not available, so the current probability of exploitation cannot be quantified; however, the vulnerability requires no authentication to first inject the payload, though it relies on an administrator later reviewing the entry. The vulnerability is not listed in CISA’s KEV catalog, but its impact on the administrative session makes it a significant risk for affected sites.