Stored XSS via unsanitized persisted input

Stored XSS in Quill Forms 5.7.1 and earlier allows remote attackers to inject script into pages that execute in visitors' browsers. The published records do not identify the submission route, field, persistence function, or output sink; they state only that attacker-controlled input is stored without sufficient sanitization and later rendered without proper escaping. Exposure is limited to sites that run the plugin and accept attacker-controlled submissions, but no authentication is required and any user who views an injected page runs the payload in the site origin.