Easy Forms for MailChimp < 6.8.9 - Admin+ Stored XSS

The plugin does not sanitise and escape some of its from parameters, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

PoC

Edit a form and put the following payload in the Form Name: "> The XSS will be triggered when viewing the form list (/wp-admin/admin.php?page=yikes-inc-easy-mailchimp) (<= 6.8.8), as well on page/post where the form is embed (via the shortcode) (< 6.8.7)