Fluent Forms < 6.2.8 - Unauthenticated Stored XSS via Name Field Nested `password` Member

Description

The plugin does not properly sanitize nested array members of composite form fields, allowing unauthenticated users to store arbitrary JavaScript that is executed when a submission is viewed in the entries screen.

The recursive input sanitizer overwrote its own attribute accumulator inside the loop, so every array member after the first resolved to a bare top-level key instead of its real nested path. A member named `password` nested inside the Name field therefore resolved to the form's Password field, whose branch only trims the value, storing the payload unescaped.