Brave Popup Builder < 0.8.6 - Unauthenticated Reflected XSS via UTM Parameters

Description

Brave Popup Builder (brave-popup-builder) up to version 0.8.5 reflects UTM query parameters into popup form HTML without escaping them.

If a form field uses defaultType = "utm", the plugin pulls the matching $_GET value and prints it straight into the page - no esc_attr(), esc_html(), or esc_textarea(). The issue is in lib/frontend/Form.php: renderInput() around line 408, renderHidden() (442-456), and renderTextarea() (475-484).

This gives you unauthenticated reflected XSS. An attacker sends someone a link with a malicious utm_* parameter; when the victim opens it on a page that loads a published popup with a UTM field, the payload runs in their browser. The site admin never has to paste attack code a normal UTM tracking field is enough. If an admin clicks the same link while logged in, they're affected too.