Gravity Forms Unauthenticated Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in the Gravity Forms plugin for WordPress, affecting versions 2.10.0 and prior. The issue arises from inadequate input validation and output escaping in the SingleProduct field when used within a Repeater field. This vulnerability allows unauthenticated attackers to inject arbitrary HTML and JavaScript into the product name field, which is then saved to the database without proper sanitization. When an administrator views the entry, the injected script executes in their browser, potentially leading to malicious exploitation.

Impact

Exploitation of this vulnerability allows for unauthenticated stored cross-site scripting, where injected scripts are executed in the context of an administrator's browser session.

Remediation

Users are advised to update the Gravity Forms plugin to version 2.10.1 or a newer patched version.