CVE-2024-13378

The Gravity Forms plugin contains a stored cross-site scripting vulnerability in versions 2.9.0.1 through 2.9.1.3 affecting the 'style_settings' parameter, which fails to properly sanitize user input and escape output. Unauthenticated attackers can exploit this to inject malicious scripts that execute when users view compromised pages, though the vulnerability only functions in Chrome browsers and requires direct access to the media file through its attachment post. The issue has been resolved in version 2.9.2.

Based on public CVE data (MITRE/NVD).