Stored XSS in Form Builder Submissions Admin List

The custom_date_key post-meta value (populated from a form's custom-date field submission) was echoed directly into the admin submissions list column without escaping, so a script payload submitted through that field would execute in an administrator's browser when viewing the submissions list. Fixed by wrapping the output in esc_html(). This... Weiterlesen