The Gravity Forms plugin for WordPress contains a stored XSS flaw in versions up to and including 2.10.0. The form’s Calculation Product field product names are not validated or escaped; the validate() method ignores the product name, and sanitize_entry_value() returns the raw value. When an entry is displayed by the administrator, the raw product name is concatenated into the output string and rendered by the repeater without escaping, allowing an attacker to inject arbitrary scripts.

Any WordPress site using the Gravity Forms plugin with version 2.10.0 or earlier is affected. The vendor/product is Gravity Forms: Gravity Forms. No further sub‑version details are listed, so all releases up to 2.10.0 are vulnerable.

The CVSS score of 7.2 reflects a medium to high severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. Attackers can submit a crafted form entry without authentication; the malicious script executes only when an authenticated administrator with gravityforms_view_entries capability views the entry detail page. The lack of authentication for the initial entry submission and the administrative context of the script execution make this a high‑risk scenario for compromised sites.