The Gravity Forms plugin for WordPress versions up to and including 2.10.0 contains an unauthenticated stored cross-site scripting (XSS) vulnerability. This flaw arises from improper input validation and output escaping of product names in Calculation Product fields within Repeater fields. An attacker can inject malicious scripts via form submissions that execute when an authenticated administrator views the entry details in wp-admin.