curl -s "http://target-site.com/wp-content/plugins/sureforms/languages/sureforms.pot" | grep "Project-Id-Version"

// Function Xv: Pre-processing field values
var Xv = function(input) {
    var value = input.value;
    
    // VULNERABILITY ROOT CAUSE:
    // If the string contains HTML entities (e.g., <), create a textarea,
    // inject the content, and extract the value. 
    // This effectively DECODES HTML entities back to raw HTML tags.
    // Example: "<img ...>" becomes ""
    
    if (typeof value === "string" && value.match(/&[a-zA-Z0-9#]+;/)) {
        var textarea = document.createElement("textarea");
        textarea.innerHTML = value;
        
        // Logic to revert sanitization
        if (textarea.value.includes("<") || textarea.value.includes(">")) {
             value = textarea.value; // Now 'value' contains RAW HTML
        }
    }
    return { ...input, value: value };
}

// Function Jv: Rendering the field
var Jv = function(props) {
    var field = props.field;
    var val = field.value; // This value is now raw HTML (post-decoding)

    // THE TRIGGER: Check if the string looks like HTML
    if (typeof val === "string" && val.match(/<[^>]+>/g)) {
        // THE SINK: Render using dangerouslySetInnerHTML WITHOUT client-side sanitization (e.g., DOMPurify)
        return React.createElement("span", {
            dangerouslySetInnerHTML: { __html: val }
        });
    }
    
    // Safe render for non-HTML text
    return React.createElement("span", null, val);
}