Patched XSS vulnerablity by jacobd91 · Pull Request #263 · BoldGrid/weforms

jacobd91 · 2026-02-27T18:11:48Z

Manual Testing Guide

Prerequisites

A WordPress install with weForms active
A weForms form containing a Hidden Field (note its meta
key name)
A page with the form shortcode (e.g. [weforms id="172"])
A Subscriber-level user account with an Application
Password (WP Admin → Users → Edit User → Application
Passwords)
Note the form ID and page ID

Step 1 — Get a WPUF nonce

curl -s -u 'SUBSCRIBER_USER:APP_PASSWORD'
"https://yoursite.com/wp-json/wp/v2/pages/PAGE_ID"
| grep -o 'value="[a-f0-9]*"' | head -1

Copy the nonce value from the output.

Step 2 — Submit an XSS payload via REST API

curl -s -X POST -u 'SUBSCRIBER_USER:APP_PASSWORD'
-d '_wpnonce=NONCE&hidden_test=%22%3E%3Cimg+src%3Dx+onerr
or%3Dalert%28document.cookie%29%3E&name%5Bfirst%5D=Test&nam
e%5Blast%5D=User&email=test%40test.com&message=test+message
&form_id=FORM_ID'
"https://yoursite.com/wp-json/weforms/v1/forms/FORM_ID/en
tries/"

Expected response (patched): the hidden_test value in the
response data should be ">" — the tag stripped.

Expected response (unpatched): the full payload "> appears unsanitized.

Step 3 — Verify no XSS in the entries list

Log in as admin and navigate to weForms → (your form) →
Entries.

Patched: no alert() dialog; hidden field column shows ">
as plain text
Unpatched: alert() fires on page load

Step 4 — Verify no XSS in the entry detail view

Click Details on the entry submitted in Step 2.

Patched: hidden field value shows as escaped text ">; no
dialog
Unpatched: alert() fires

Step 5 — Verify textarea display is unaffected

Submit a normal entry through the front-end form (or via
the same curl command with a clean message value). Open the
entry detail view.

Patched: the Message field renders its content normally
(paragraph-wrapped text displays as formatted text, not as
escaped <p> tags)

Step 6 — Verify normal hidden field values are unaffected

Submit with a clean hidden field value:

curl -s -X POST -u 'SUBSCRIBER_USER:APP_PASSWORD'
-d '_wpnonce=NONCE&hidden_test=my-tracking-value&name%5Bf
irst%5D=Test&name%5Blast%5D=User&email=test%40test.com&mess
age=test+message&form_id=FORM_ID'
"https://yoursite.com/wp-json/weforms/v1/forms/FORM_ID/en
tries/"

Expected: hidden_test stored and displayed as
my-tracking-value with no truncation or mangling.

Copilot

Pull request overview

This PR addresses an XSS vector in weForms entry handling by sanitizing stored entry values (notably for hidden fields submitted via the REST API) and by removing unsafe HTML rendering in the admin SPA entry list/detail UI.

Changes:

Sanitize scalar entry values in the default prepare_entry() flow to prevent unsanitized hidden-field payloads submitted via REST.
Replace v-html rendering with Vue’s escaped interpolation for entry list/table cells.
Restrict v-html usage in the entry single/detail view to textarea fields (and keep existing special cases like address).

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 4 comments.

File	Description
includes/fields/class-abstract-fields.php	Sanitizes default scalar entry values during entry preparation (impacts hidden field REST submissions).
assets/spa/components/form-entry-single/template.php	Adjusts entry-detail rendering to avoid `v-html` for most field types, limiting raw HTML rendering to textarea.
assets/js-templates/spa-components.php	Updates generated SPA templates to escape entry field values in list/detail views instead of rendering raw HTML.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-02-27T18:27:35Z

assets/js-templates/spa-components.php

                            <input type="checkbox" name="post[]" v-model="checkedItems" :value="entry.id">
                        </th>
-                        <td v-for="(header, index) in columns"><span v-html="entry.fields[index]"></span></td>
+                        <td v-for="(header, index) in columns"><span>{{ entry.fields[index] }}</span></td>


The SPA table template in this generated file is now escaping entry.fields[index], but the source Vue template (assets/spa/components/component-table/template.php) still uses v-html for the same cells. That mismatch is likely to reintroduce the XSS if assets/templates are regenerated from source; update the source template to keep them consistent.

Copilot · 2026-02-27T18:27:35Z

assets/js-templates/spa-components.php

                        <input type="checkbox" name="post[]" v-model="checkedItems" :value="entry.id">
                    </th>
-                    <td v-for="(header, index) in columns"><span v-html="entry.fields[index]"></span></td>
+                    <td v-for="(header, index) in columns"><span>{{ entry.fields[index] }}</span></td>


Same as above: this second table row template now escapes entry.fields[index], but the corresponding source template (assets/spa/components/component-table/template.php) still renders it with v-html. Please update the source template as well so a rebuild doesn’t reintroduce the XSS.

Copilot · 2026-02-27T18:27:35Z

assets/spa/components/form-entry-single/template.php

                                            <div v-else-if="field.type === 'country_list_field'">{{ getCountryName( field.value ) }}</div>
                                            <div v-else-if="field.type === 'address_field'" v-html="getAddressFieldValue( field.value)"></div>
-                                            <div v-else v-html="field.value"></div>
+                                            <div v-else-if="field.type === 'textarea_field'" v-html="field.value"></div>


The fallback renderer now uses {{ field.value }} for all non-textarea fields. Several entry field types are prepared server-side as HTML strings (e.g., file/image uploads as <a> links, signature fields as <img>, some grid fields as HTML tables), so this change will cause those fields to display escaped HTML markup in the entry detail view. Consider adding explicit handling for those HTML-producing field types (or changing the API to return structured data/plain text and render it safely) so their display doesn’t regress while still avoiding XSS.

Suggested change

<div v-else-if="field.type === 'textarea_field'" v-html="field.value"></div>

<div v-else-if="field.type === 'textarea_field'" v-html="field.value"></div>

<div

v-else-if="

field.type === 'file_upload' ||

field.type === 'image_upload' ||

field.type === 'signature_field' ||

field.type === 'repeat_field' ||

field.type === 'grid_field'

"

v-html="field.value">

</div>

Copilot · 2026-02-27T18:27:36Z

assets/js-templates/spa-components.php

                                            <div v-else-if="field.type === 'country_list_field'">{{ getCountryName( field.value ) }}</div>
                                            <div v-else-if="field.type === 'address_field'" v-html="getAddressFieldValue( field.value)"></div>
-                                            <div v-else v-html="field.value"></div>
+                                            <div v-else-if="field.type === 'textarea_field'" v-html="field.value"></div>


The entry-detail template now escapes field.value for all non-textarea fields. Backend entry rendering produces HTML strings for some field types (e.g., file/image uploads, signature fields, grid fields), so those will now show up as escaped markup instead of rendered content in the entry detail view. Either add explicit v-html handling for the specific safe HTML-producing types (with server-side escaping/kses), or refactor the API to return structured data and render it without v-html.

Suggested change

<div v-else-if="field.type === 'textarea_field'" v-html="field.value"></div>

<div v-else-if="field.type === 'textarea_field'" v-html="field.value"></div>

<div v-else-if="field.type === 'file_upload' || field.type === 'image_upload' || field.type === 'signature' || field.type === 'grid'" v-html="field.value"></div>

Patched XSS vulnerablity

b143402

jacobd91 requested review from Copilot and cssjoe February 27, 2026 18:11

jacobd91 self-assigned this Feb 27, 2026

jacobd91 marked this pull request as draft February 27, 2026 18:11

Copilot started reviewing on behalf of jacobd91 February 27, 2026 18:12 View session

jacobd91 marked this pull request as ready for review February 27, 2026 18:20

Copilot AI reviewed Feb 27, 2026

View reviewed changes

Updated version numbers and changelog

bdd94ba

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Patched XSS vulnerablity#263

Patched XSS vulnerablity#263
jacobd91 wants to merge 2 commits intomasterfrom
ENG7-1407-xss-vul

jacobd91 commented Feb 27, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Feb 27, 2026

Uh oh!

Copilot AI Feb 27, 2026

Uh oh!

Copilot AI Feb 27, 2026

Uh oh!

Copilot AI Feb 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

-                                            <div v-else-if="field.type === 'textarea_field'" v-html="field.value"></div>
+                                            <div v-else-if="field.type === 'textarea_field'" v-html="field.value"></div>
+                                            <div
+                                                v-else-if="
+                                                    field.type === 'file_upload' ||
+                                                    field.type === 'image_upload' ||
+                                                    field.type === 'signature_field' ||
+                                                    field.type === 'repeat_field' ||
+                                                    field.type === 'grid_field'
+                                                "
+                                                v-html="field.value">
+                                            </div>

	<div v-else-if="field.type === 'textarea_field'" v-html="field.value"></div>
	<div v-else-if="field.type === 'textarea_field'" v-html="field.value"></div>
	<div v-else-if="field.type === 'file_upload' \|\| field.type === 'image_upload' \|\| field.type === 'signature' \|\| field.type === 'grid'" v-html="field.value"></div>

Conversation

jacobd91 commented Feb 27, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Feb 27, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 27, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 27, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 27, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants