The Gravity Forms WordPress plugin up to version 2.10.0 is vulnerable to stored cross-site scripting (XSS) due to improper validation and output escaping of Product Option field values. An attacker can inject malicious scripts into entry data that execute when an administrator views the Order Summary section of entry details.