WPForms < 2.0.2.2 - Reflected Cross-Site Scripting via 'query_var' Smart Tag in iframe srcdoc Attribute

Description

The plugin is vulnerable to Reflected Cross-Site Scripting via an attacker-chosen query-string key referenced by a {query_var} Smart Tag due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can trick a user into clicking a crafted link. Exploitation requires that a site administrator has previously saved a form whose description embeds a {query_var} Smart Tag inside an iframe srcdoc attribute and has enabled Show Description on a public-facing page.