The Gravity Forms WordPress plugin up to version 2.10.0 has an unauthenticated stored cross-site scripting (XSS) vulnerability. This occurs when SingleProduct fields nested inside Repeater fields bypass proper input validation, allowing attackers to inject malicious HTML and JavaScript into product name fields. The malicious payload is stored in the database and executes in the administrator's browser when viewing entries in the admin panel.