The Gravity Forms plugin for WordPress versions up to and including 2.10.0 is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. This vulnerability arises from insufficient input validation and output escaping on Hidden Product field values within Repeater fields. An unauthenticated attacker can inject malicious scripts via form submissions, which execute when an administrator views the affected entry details.