Gravity Forms — Reflected XSS via gform_get_config

POST /wp-admin/admin-ajax.php · form_ids parameter · Unescaped reflection in text/html response

Exploit delivers via popup window (X-Frame-Options: SAMEORIGIN blocks iframe rendering)
XSS payload renders in a new window in the target's origin context.
Ensure your browser allows popups for this page.
Vulnerability Details 
Endpoint:    POST /wp-admin/admin-ajax.php
Action:      gform_get_config
Parameter:   args → form_ids[] (JSON array value)
Reflection:  Unescaped in text/html response body
Context:     JSON key inside <!-- gf:json_start --> ... <!-- gf:json_end -->
Impact:      Full JavaScript execution in victim's browser session
Prereqs:     Valid config_nonce (publicly available on any page with a GF form)
CVSS 3.1:   6.1 (Medium) — AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Response sample:
  Content-Type: text/html; charset=UTF-8
  <!-- gf:json_start -->{"success":true,"data":{"common":{"form":{"pagination":{"PAYLOAD":null}}}}}<!-- gf:json_end -->