The Gravity Forms plugin for WordPress up to and including version 2.10.5 is vulnerable to stored Cross-Site Scripting (XSS) via the Post Body field value. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts that execute when users access affected pages. The issue persists because wp_kses_post permits certain HTML tags and attributes, and the client-side tooltip script re-parses the aria-label attribute as innerHTML, leaving event-handler attributes like onerror executable.