Threats tagged 'ghsa-774g-h2fq-p98f'

The Gravity Forms plugin for WordPress versions up to and including 3.1.2 contains a stored cross-site scripting (XSS) vulnerability via the List Field. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary scripts. Exploitation requires an administrator to click a crafted link in the entry detail view and confirm a dialog, triggering execution of attacker-supplied JavaScript code.