Forminator Forms < 1.56.2 - Unauthenticated Stored XSS via Forged Upload Record in 'select-' Field

Description

The plugin is vulnerable to Stored Cross-Site Scripting via a forged upload record submitted through a select field, due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit is possible because Forminator_Core::sanitize_array() skips all filtering for keys prefixed with 'select-', and set_field_data() treats a submitted 'return' member as a trusted internal flag — allowing an unauthenticated attacker to forge and persist a complete upload field record with an arbitrary file_url value without any sanitization or validation.