WS Form < 1.8.176 - Admin+ Stored Cross-Site Scripting

The plugins do not sanitise and escape their Form Name, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

Create a form and put the following payload in the Form Title: "><img src onerror=alert(/XSS/)>

The XSS will be triggered in the Forms list, as well as when viewing/previewing the form