CVE-2020-27851: 
PHP vulnerability analysis and mitigation

Multiple stored HTML injection vulnerabilities were discovered in the 'poll' and 'quiz' features of Rocketgenius Gravity Forms plugin (before version 2.4.21). The vulnerability was disclosed on January 20, 2021, and allows remote attackers to inject arbitrary HTML code through poll or quiz answers. This injected code can then be executed when viewed by users with privileged roles such as Administrators or Editors (AttackerKB, NVD).

The vulnerability has been assigned a CVSS v3.1 Base Score of 5.4 (Medium severity). The attack vector is network-based, requires low privileges, and user interaction is necessary for successful exploitation. The vulnerability affects the scope in a changed context and has low impact on both confidentiality and integrity (AttackerKB).

When successfully exploited, the vulnerability allows attackers to inject arbitrary HTML code that gets executed in the context of privileged users viewing the affected poll or quiz content. This could potentially lead to unauthorized actions being performed with administrative privileges (AttackerKB).

The vulnerability requires an attacker to have low-level privileges to submit content to polls or quizzes, and relies on a privileged user (Administrator, Editor, etc.) to view the malicious content for successful exploitation (AttackerKB).

The recommended mitigation is to upgrade Rocketgenius Gravity Forms to version 2.4.21 or later, which contains fixes for this vulnerability (NVD).