CVE-2026-2002-poc

public function markup( $field, $views_obj ) {
        $settings = $views_obj->model->settings;

        $html    = '';
        $label   = esc_html( self::get_property( 'field_label', $field ) );
        $id      = self::get_property( 'element_id', $field );
        $form_id = false;

        $html .= '<div class="forminator-field forminator-merge-tags" data-field="' . $id . '">';

        if ( $label ) {

            $html .= sprintf(
                '<label class="forminator-label">%s</label>',
                self::convert_markdown( $label )
            );
        }

            // Check if form_id exist.
        if ( isset( $settings['form_id'] ) ) {
            $form_id = $settings['form_id'];
        }

        // To allow iframes in content.
        add_filter( 'wp_kses_allowed_html', array( 'Forminator_Core', 'add_iframe_to_kses_allowed_html' ) );
        $content = wp_kses_post( self::get_property( 'variations', $field ) );  // root cause here
        remove_filter( 'wp_kses_allowed_html', array( 'Forminator_Core', 'add_iframe_to_kses_allowed_html' ) );

        $html .= forminator_replace_variables(
            $content,
            $form_id
        );

        $html .= '</div>';

        return $html;
    }