The Gravity Forms plugin for WordPress contains a flaw that allows any unauthenticated user to inject a stored XSS payload via a hidden consent field. The vulnerability arises from a mis‑implemented state validation that compares hashes of input before and after sanitization. When a payload is stripped by wp_kses but the original raw value is stored, the plugin renders the raw value without escaping on the Entries List page. This permits an attacker to supply malicious script that will execute when an authenticated administrator views the form entries. The impact is that the attacker can run arbitrary client‑side code with the privileges of the administrator, potentially exfiltrating data or performing additional attacks against the site.

Anyone running the Gravity Forms WordPress plugin version 2.10.0 or earlier is affected. The issue applies to installations of Gravity Forms up to and including 2.10.0 built on the standard WordPress environment. No specific operating system or PHP version constraints are documented.

The CVSS score of 7.2 indicates a high‑moderate risk. EPSS information is not available, and the vulnerability is not listed in CISA's KEV catalog. Attackers require only unauthenticated access to the publicly exposed form to inject the payload, and the exploitation succeeds when an administrator subsequently views the entries list. Given that many sites expose Gravity Forms on the public Internet, the likelihood of exploitation in the wild remains uncertain but should be considered a moderate threat, especially for sites with sensitive data or high‑value administrators.