The Gravity Forms plugin for WordPress versions up to and including 2.10.0 is vulnerable to stored cross-site scripting (XSS) via the Consent field hidden inputs. This vulnerability arises from a flawed state validation mechanism that improperly validates input sanitized by wp_kses(), allowing malicious scripts to be stored and executed when an administrator views the Entries List page. Unauthenticated attackers can exploit this to execute arbitrary scripts in the context of authenticated administrators.