MW WP Form < 5.1.8 - Unauthenticated Stored XSS via 'post_id' Parameter

Description

The plugin is vulnerable to Stored Cross-Site Scripting via the 'post_id' parameter due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The CSRF gate protecting form submission (MW_WP_Form_Csrf) is bypassable by any unauthenticated visitor who first loads the public form page to obtain a valid double-submit cookie, leaving no effective barrier to storing malicious payloads.