The vulnerability is a stored cross‑site scripting flaw that originates from the Hidden Product field inside Repeater subfields. When attackers submit a form, the product name is stored without proper validation or escaping, and later displayed within the form entry details. As a result, arbitrary scripts can execute whenever an administrator views the entry, allowing the attacker to run code in the context of the WP interface.

The flaw affects the Gravity Forms plugin for WordPress versions 2.10.0 and earlier. Any site deploying Gravity Forms in those periods—particularly those using repeater fields with hidden product inputs—could be compromised. The vulnerability is exploitable during normal form usage and does not require elevated privileges to insert the malicious payload.

The CVSS score of 7.2 indicates a high‑severity condition. Because the flaw is unauthenticated and is triggered through publicly accessible forms, the likelihood of exploitation is significant, even though no EPSS figure is available. The attack vector is inferred to be remote via HTTP/S to the site’s WordPress frontend, and the issue is not noted in the CISA KEV catalog. Administrators should treat this as a serious risk requiring prompt remediation.