Gravity Forms processes certain field types—Post Excerpt, Post Custom Field, and Rich‑Text Paragraph fields—without proper sanitization of raw HTML. Attackers can embed arbitrary web scripts that are saved to the database and later rendered by the plugin’s admin JavaScript. When a user loads a page containing the stored payload, the browser executes the script, enabling defacement, cookie theft, session hijacking, and other client‑side attacks. This flaw corresponds to the Common Weakness Enumeration CWE‑79.

The vulnerability affects all installations of the Gravity Forms WordPress plugin version 3.1.1 and earlier. Any site that hosts forms with the aforementioned field types and allows raw HTML input is susceptible. The problem manifests both on the admin side—while the data is submitted—and on the public pages that display the stored content.

The CVSS score of 7.2 classifies this as a high‑severity flaw, and the lack of authentication requirements means an attacker can exploit it without privileged access. Although no EPSS value is available and the issue is not listed in CISA KEV, the stored‑XSS nature of the exploit and the widespread use of Gravity Forms make this a realistic threat for exposed WordPress sites. An attacker simply submits malicious payloads through a public form or via the plugin’s backend interface to implant scripts that will run for any subsequent visitor to the affected page.