CVE-2020-27852: 
PHP vulnerability analysis and mitigation

A stored Cross-Site Scripting (XSS) vulnerability in the survey feature in Rocketgenius Gravity Forms before version 2.4.21 allows remote attackers to inject arbitrary web script or HTML via a textarea field. This vulnerability, identified as CVE-2020-27852, was disclosed on January 19, 2021. The injected code is interpreted by users in privileged roles such as Administrator or Editor (NVD).

The vulnerability exists in the survey feature of Gravity Forms, specifically affecting versions prior to 2.4.21. It allows attackers to perform stored XSS attacks by injecting malicious code through textarea fields. The vulnerability requires low privileges to exploit and user interaction is required for successful exploitation (AttackerKB).

When successfully exploited, this vulnerability allows attackers to inject arbitrary web script or HTML that gets executed when viewed by users with privileged roles (Administrator, Editor, etc.). This could potentially lead to unauthorized actions being performed with administrative privileges (NVD).

The vulnerability requires low privileges to exploit and user interaction is necessary. The attack vector is through the network, and the attacker needs to have access to submit form data through the textarea field (AttackerKB).

The primary mitigation is to upgrade Gravity Forms to version 2.4.21 or later, which contains the security fix for this vulnerability (NVD).