This vulnerability involves improper input sanitization in Gravity Forms CSS Themes with Fontawesome and Placeholders by Maros Pristas, leading to stored cross-site scripting (XSS). Attackers can inject malicious scripts that persist and execute when other users access the affected web pages. The issue affects versions up to and including 8.5. The CVSS vector indicates network attack vector, low attack complexity, high privileges required, user interaction required, and impacts confidentiality, integrity, and availability at a low to medium level.

Successful exploitation could allow an attacker with high privileges and requiring user interaction to execute arbitrary scripts in the context of other users, potentially leading to information disclosure, modification of data, or disruption of service. The impact is rated medium with partial confidentiality, integrity, and availability impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, limit exposure by restricting high privilege user access and minimizing user interaction with untrusted inputs in the affected product.