This flaw in Repeater Fields for Gravity Forms arises from lack of proper sanitization for multi‑input sub‑field values, allowing attackers to embed malicious scripts that are stored and later rendered on any page that displays the repeater data. When a victim visits a page containing the compromised form outputs, the injected script runs in the victim’s browser, potentially stealing session cookies, performing actions on behalf of the user, or defacing the site. The vulnerability does not affect the server backend directly, but the consequence is full cross‑site scripting on the site’s front‑end.

The issue impacts the WordPress plugin Repeater Fields for Gravity Forms from addonsorg, specifically all versions up to and including 3.0.4. The problem is limited to multi‑input sub‑field types such as name, address, and checkbox widgets; single‑input fields are protected with esc_html() in 3.0.4.

The CVSS score of 7.2 reflects a high severity of the stored XSS flaw. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is unauthenticated submission of crafted repeater values through the plugin’s interface, which permanently stores the malicious payload and executes it when any user views the form output.