Stored XSS from ticket messages in admin table in SupportFlow

How it was found

SupportFlow containers a stored XSS vulnerability in how it generates the admin table of tickets at SupportFlow -> All Tickets (/wp-admin/edit.php?post_type=sf_ticket).

Any ticket can be created with an XSS payload like this:

<script>alert('XSS');</script>

When an admin goes to view the table of tickets, XSS is triggered, because the value is never escaped here:

https://github.com/SupportFlow/supportflow/blob/71a6053848c523f7b50b61a1f3770013badc76c0/classes/class-supportflow-admin.php#L1175

I've attached a screenshot demonstrating the XSS payload - please let me know if there are any questions.