Threats tagged 'ghsa-8r7c-j2qw-g3gp'

The Gravity Forms plugin for WordPress up to version 3.1.1 is vulnerable to stored cross-site scripting (XSS) due to insufficient input sanitization and output escaping in certain fields. This vulnerability allows unauthenticated attackers to inject arbitrary scripts that execute when users access affected pages. The issue arises because some fields allow raw HTML submissions that bypass sanitization and are later decoded into executable markup by the browser.