Gravity Forms (<= 3.1.2)

The Gravity Forms plugin for WordPress (all versions up to, and including, 3.1.2) is vulnerable to Stored Cross-Site Scripting (XSS) via the List Field due to insufficient input sanitization and output escaping.

Gravity Forms for WordPress versions up to and including 3.1.2 is vulnerable to unauthenticated PHP object injection via Post Custom Fields, which can lead to remote code execution when combined with specific gadget chains.