Patched XSS vulnerablity

[jacobd91]

https://imh-internal.atlassian.net/browse/ENG7-1407

Manual Testing Guide

Prerequisites

1. A WordPress install with weForms active
2. A weForms form containing a Hidden Field (note its meta
   key name)
3. A page with the form shortcode (e.g. [weforms id="172"])
4. A Subscriber-level user account with an Application
   Password (WP Admin → Users → Edit User → Application
   Passwords)
5. Note the form ID and page ID

---

Step 1 — Get a WPUF nonce

curl -s -u 'SUBSCRIBER_USER:APP_PASSWORD' "https://yoursite.com/wp-json/wp/v2/pages/PAGE_ID"  | grep -o 'value="[a-f0-9]*"' | head -1

Copy the nonce value from the output.

---

Step 2 — Submit an XSS payload via REST API

curl -s -X POST -u 'SUBSCRIBER_USER:APP_PASSWORD' -d '_wpnonce=NONCE&hidden_test=%22%3E%3Cimg+src%3Dx+onerror%3Dalert%28document.cookie%29%3E&name%5Bfirst%5D=Test&name%5Blast%5D=User&email=test%40test.com&message=test+message&form_id=FORM_ID' "https://yoursite.com/wp-json/weforms/v1/forms/FORM_ID/entries/"

Expected response (patched): the hidden_test value in the
response data should be ">" — the tag stripped.

Expected response (unpatched): the full payload "> appears unsanitized.

---

Step 3 — Verify no XSS in the entries list

Log in as admin and navigate to weForms → (your form) →
Entries.

• Patched: no alert() dialog; hidden field column shows ">
  as plain text
• Unpatched: alert() fires on page load

---

Step 4 — Verify no XSS in the entry detail view

Click Details on the entry submitted in Step 2.

• Patched: hidden field value shows as escaped text ">; no
  dialog
• Unpatched: alert() fires

---

Step 5 — Verify textarea display is unaffected

Submit a normal entry through the front-end form (or via
the same curl command with a clean message value). Open the
entry detail view.

• Patched: the Message field renders its content normally
  (paragraph-wrapped text displays as formatted text, not as
  escaped <p> tags)

---

Step 6 — Verify normal hidden field values are unaffected

Submit with a clean hidden field value:

curl -s -X POST -u 'SUBSCRIBER_USER:APP_PASSWORD' -d '_wpnonce=NONCE&hidden_test=my-tracking-value&name%5Bfirst%5D=Test&name%5Blast%5D=User&email=test%40test.com&message=test+message&form_id=FORM_ID' "https://yoursite.com/wp-json/weforms/v1/forms/FORM_ID/entries/"

Expected: hidden_test stored and displayed as
my-tracking-value with no truncation or mangling.

[Copilot]

Pull request overview

This PR addresses an XSS vector in weForms entry handling by sanitizing stored entry values (notably for hidden fields submitted via the REST API) and by removing unsafe HTML rendering in the admin SPA entry list/detail UI.

Changes:

• Sanitize scalar entry values in the default prepare_entry() flow to prevent unsanitized hidden-field payloads submitted via REST.
• Replace v-html rendering with Vue’s escaped interpolation for entry list/table cells.
• Restrict v-html usage in the entry single/detail view to textarea fields (and keep existing special cases like address).

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 4 comments.

File	Description
includes/fields/class-abstract-fields.php	Sanitizes default scalar entry values during entry preparation (impacts hidden field REST submissions).
assets/spa/components/form-entry-single/template.php	Adjusts entry-detail rendering to avoid v-html for most field types, limiting raw HTML rendering to textarea.
assets/js-templates/spa-components.php	Updates generated SPA templates to escape entry field values in list/detail views instead of rendering raw HTML.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.