Formidable Forms < 6.34 - Unauthenticated Stored XSS via 'frm_user_id' Parameter

Description

The plugin is vulnerable to Stored Cross-Site Scripting via the 'frm_user_id' parameter due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. By forging frm_user_id to match an administrator's user ID — discoverable via the public WordPress REST API — an unauthenticated attacker causes wp_kses_post() to serve as the only output filter, which preserves the injected payload structurally intact; the plugin's admin JavaScript then decodes and executes it automatically on page load.