Stored XSS in Repeater Fields for Gravity Forms Plugin

The Repeater Fields for Gravity Forms plugin for WordPress (versions up to and including 3.0.4) contains a vulnerability to Stored Cross-Site Scripting (XSS). The flaw stems from insufficient input sanitization and output escaping within multi-input sub-fields such as Name, Address, and Checkbox fields. Unlike scalar single-input fields, which are protected by esc_html() in version 3.0.4, these complex sub-fields allow an unauthenticated attacker to inject malicious scripts into the application. Once stored, these scripts execute within the context of a user's browser whenever the affected page is loaded. This poses a significant risk for account takeover or unauthorized actions if an administrative user views the injected content.

Impact

Successful exploitation allows unauthenticated attackers to inject malicious web scripts into WordPress pages. If these scripts are executed in the context of an administrator's session, attackers could potentially perform unauthorized administrative actions, steal session cookies, or redirect users to malicious domains.

Recommendation

Update the Repeater Fields for Gravity Forms plugin to the latest version beyond 3.0.4 to ensure proper output escaping is applied to all sub-field types. Monitor server-side web application logs for POST requests containing script tags or JavaScript event handlers directed at endpoints processing Gravity Forms submissions.