diff --git a/assets/js-templates/spa-components.php b/assets/js-templates/spa-components.php
index 24b66f7..9aeeee0 100644
--- a/assets/js-templates/spa-components.php
+++ b/assets/js-templates/spa-components.php
@@ -77,7 +77,7 @@
                         <th scope="row" class="check-column">
                             <input type="checkbox" name="post[]" v-model="checkedItems" :value="entry.id">
                         </th>
-                        <td v-for="(header, index) in columns"><span v-html="entry.fields[index]"></span></td>
+                        <td v-for="(header, index) in columns"><span>{{ entry.fields[index] }}</span></td>
                         <th class="col-entry-details">
                             <template v-if="status == 'trash'">
                                 <a href="#" @click.prevent="restore(entry.id)"><?php esc_html_e( 'Restore', 'weforms' ); ?></a>
@@ -96,7 +96,7 @@
                     <th scope="row" class="check-column">
                         <input type="checkbox" name="post[]" v-model="checkedItems" :value="entry.id">
                     </th>
-                    <td v-for="(header, index) in columns"><span v-html="entry.fields[index]"></span></td>
+                    <td v-for="(header, index) in columns"><span>{{ entry.fields[index] }}</span></td>
                     <th class="col-entry-details">
                         <template v-if="status == 'trash'">
                             <a href="#" @click.prevent="restore(entry.id)"><?php esc_html_e( 'Restore', 'weforms' ); ?></a>
@@ -425,7 +425,9 @@
                                             </div>
                                             <div v-else-if="field.type === 'country_list_field'">{{ getCountryName( field.value ) }}</div>
                                             <div v-else-if="field.type === 'address_field'" v-html="getAddressFieldValue( field.value)"></div>
-                                            <div v-else v-html="field.value"></div>
+                                            <div v-else-if="field.type === 'textarea_field'" v-html="field.value"></div>
+                                            <div v-else-if="field.type === 'image_upload' || field.type === 'file_upload' || field.type === 'signature_field' || field.type === 'checkbox_grid' || field.type === 'multiple_choice_grid' || field.type === 'multiple_product'" v-html="field.value"></div>
+                                            <div v-else>{{ field.value }}</div>
                                         </td>
                                     </tr>
                                 </template>
diff --git a/assets/spa/components/component-table/template.php b/assets/spa/components/component-table/template.php
index a6c6614..3875fc9 100644
--- a/assets/spa/components/component-table/template.php
+++ b/assets/spa/components/component-table/template.php
@@ -81,7 +81,7 @@
                         <th class="col-entry-id">
                             <router-link :to="{ name: 'formEntriesSingle', params: { entryid: entry.id }}">#{{ entry.id }}</router-link>
                         </th>
-                        <td v-for="(header, index) in columns"><span v-html="entry.fields[index]"></span></td>
+                        <td v-for="(header, index) in columns"><span>{{ entry.fields[index] }}</span></td>
                         <th class="col-entry-details">
                             <template v-if="status == 'trash'">
                                 <a href="#" @click.prevent="restore(entry.id)"><?php _e( 'Restore', 'weforms' ); ?></a>
@@ -103,7 +103,7 @@
                     <th class="col-entry-id">
                         <router-link :to="{ name: 'formEntriesSingle', params: { entryid: entry.id }}">#{{ entry.id }}</router-link>
                     </th>
-                    <td v-for="(header, index) in columns"><span v-html="entry.fields[index]"></span></td>
+                    <td v-for="(header, index) in columns"><span>{{ entry.fields[index] }}</span></td>
                     <th class="col-entry-details">
                         <template v-if="status == 'trash'">
                             <a href="#" @click.prevent="restore(entry.id)"><?php _e( 'Restore', 'weforms' ); ?></a>
diff --git a/assets/spa/components/form-entry-single/template.php b/assets/spa/components/form-entry-single/template.php
index 03c621a..9ba967c 100644
--- a/assets/spa/components/form-entry-single/template.php
+++ b/assets/spa/components/form-entry-single/template.php
@@ -40,7 +40,9 @@
                                             </div>
                                             <div v-else-if="field.type === 'country_list_field'">{{ getCountryName( field.value ) }}</div>
                                             <div v-else-if="field.type === 'address_field'" v-html="getAddressFieldValue( field.value)"></div>
-                                            <div v-else v-html="field.value"></div>
+                                            <div v-else-if="field.type === 'textarea_field'" v-html="field.value"></div>
+                                            <div v-else-if="field.type === 'image_upload' || field.type === 'file_upload' || field.type === 'signature_field' || field.type === 'checkbox_grid' || field.type === 'multiple_choice_grid' || field.type === 'multiple_product'" v-html="field.value"></div>
+                                            <div v-else>{{ field.value }}</div>
                                         </td>
                                     </tr>
                                 </template>
diff --git a/includes/api/class-weforms-forms-controller.php b/includes/api/class-weforms-forms-controller.php
index 466763d..cf4b42a 100644
--- a/includes/api/class-weforms-forms-controller.php
+++ b/includes/api/class-weforms-forms-controller.php
@@ -255,7 +255,7 @@ public function save_check( $request ) {
             $entry_fields = [];
 
             foreach ( $form_fields as $key => $field ) {
-                if ( $field['wpuf_cond']['condition_status'] == 'yes' ) {
+                if ( ! empty( $field['wpuf_cond'] ) && $field['wpuf_cond']['condition_status'] == 'yes' ) {
                     $logic          = [];
                     $cond_fields    = $field['wpuf_cond']['cond_field'];
                     $cond_operators = $field['wpuf_cond']['cond_operator'];
diff --git a/includes/class-form-entry.php b/includes/class-form-entry.php
index fb4240f..c513f69 100644
--- a/includes/class-form-entry.php
+++ b/includes/class-form-entry.php
@@ -108,6 +108,22 @@ public function populate_entry_data() {
         $grid_css_added = false;
         $grid_css       = '<style>.wpufTable {display: table; width: 100%; } .wpufTableRow {display: table-row; } .wpufTableRow:nth-child(even) {background-color: #f5f5f5; } .wpufTableHeading {background-color: #eee; display: table-header-group; font-weight: bold; } .wpufTableCell, .wpufTableHead {border: none; display: table-cell; padding: 3px 10px; } .wpufTableFoot {background-color: #eee; display: table-footer-group; font-weight: bold; } .wpufTableBody {display: table-row-group; }</style>';
 
+        // Custom allowlist for grid field HTML: wp_kses_post() strips <style> and <input>,
+        // but all dynamic values are already escaped (esc_html/esc_attr) at construction time.
+        $grid_kses_allowed = array(
+            'style' => array(),
+            'div'   => array( 'class' => true ),
+            'label' => array( 'class' => true ),
+            'input' => array(
+                'name'     => true,
+                'class'    => true,
+                'type'     => true,
+                'value'    => true,
+                'checked'  => true,
+                'disabled' => true,
+            ),
+        );
+
         $values = [];
 
         $query = $wpdb->prepare(
@@ -142,7 +158,7 @@ public function populate_entry_data() {
                     $this->raw_fields[ $result->meta_key ]['value'] = $value;
 
                     if ( $field['type'] == 'textarea_field' ) {
-                        $value = weforms_format_text( $value );
+                        $value = wp_kses_post( weforms_format_text( $value ) );
                     } elseif ( $field['type'] == 'name_field' ) {
                         $value = implode( ' ', explode( WeForms::$field_separator, $value ) );
                     } elseif ( in_array( $field['type'], [ 'dropdown_field', 'radio_field' ] ) ) {
@@ -180,16 +196,16 @@ public function populate_entry_data() {
                                 if ( $field['type'] == 'image_upload' ) {
                                     $thumb = wp_get_attachment_image( $attachment_id, 'thumbnail' );
                                 } else {
-                                    $thumb = get_post_field( 'post_title', $attachment_id );
+                                    $thumb = esc_html( get_post_field( 'post_title', $attachment_id ) );
                                 }
 
-                                $full_size = wp_get_attachment_url( $attachment_id );
+                                $full_size = esc_url( wp_get_attachment_url( $attachment_id ) );
 
-                                $file_field .= sprintf( '<a href="%s" target="_blank">%s</a> ', $full_size, $thumb );
+                                $file_field .= sprintf( '<a href="%s" target="_blank" rel="noopener noreferrer">%s</a> ', $full_size, $thumb );
                             }
                         }
 
-                        $value = $file_field;
+                        $value = wp_kses_post( $file_field );
                     } elseif ( $field['type'] == 'google_map' ) {
                         list( $address, $lat, $long ) = explode( '||', $value );
 
@@ -221,7 +237,7 @@ public function populate_entry_data() {
                                 }
                             }
 
-                            $value = implode( '<br> <br> ', $serialized_value );
+                            $value = wp_kses_post( implode( '<br> <br> ', $serialized_value ) );
                         }
                     } elseif ( $field['type'] == 'checkbox_grid' ) {
                         // Security fix: Prevent PHP Object Injection by restricting allowed classes
@@ -251,7 +267,7 @@ public function populate_entry_data() {
                                             <div class="wpufTableHead">&nbsp;</div>';
 
                                 foreach ( $field['grid_columns'] as $column ) {
-                                    $return .= '<div class="wpufTableHead">' . $column . '</div>';
+                                    $return .= '<div class="wpufTableHead">' . esc_html( $column ) . '</div>';
                                 }
 
                                 $return .= '</div>
@@ -260,7 +276,7 @@ public function populate_entry_data() {
 
                                 foreach ( $field['grid_rows'] as $row_key => $row_value ) {
                                     $return .= '<div class="wpufTableRow">
-                                                <div class="wpufTableHead">' . $row_value . '</div>';
+                                                <div class="wpufTableHead">' . esc_html( $row_value ) . '</div>';
 
                                     foreach ( $field['grid_columns'] as $column_key => $column_value ) {
                                         if ( isset( $new_val[ $row_key ] ) ) {
@@ -287,7 +303,7 @@ class="wpuf_' . $field['name'] . '_' . $this->form_id . '"
                                 </div>';
                             }
 
-                            $value = $return;
+                            $value = wp_kses( $return, $grid_kses_allowed );
                         }
                     } elseif ( $field['type'] == 'multiple_choice_grid' ) {
                         // Security fix: Prevent PHP Object Injection by restricting allowed classes
@@ -317,7 +333,7 @@ class="wpuf_' . $field['name'] . '_' . $this->form_id . '"
                                             <div class="wpufTableHead">&nbsp;</div>';
 
                                 foreach ( $field['grid_columns'] as $column ) {
-                                    $return .= '<div class="wpufTableHead">' . $column . '</div>';
+                                    $return .= '<div class="wpufTableHead">' . esc_html( $column ) . '</div>';
                                 }
 
                                 $return .= '</div>
@@ -326,7 +342,7 @@ class="wpuf_' . $field['name'] . '_' . $this->form_id . '"
 
                                 foreach ( $field['grid_rows'] as $row_key => $row_value ) {
                                     $return .= '<div class="wpufTableRow">
-                                                <div class="wpufTableHead">' . $row_value . '</div>';
+                                                <div class="wpufTableHead">' . esc_html( $row_value ) . '</div>';
 
                                     foreach ( $field['grid_columns'] as $column_key => $column_value ) {
                                         if ( isset( $new_val[ $row_key ] ) ) {
@@ -353,7 +369,7 @@ class="wpuf_' . $field['name'] . '_' . $this->form_id . '"
                                 </div>';
                             }
 
-                            $value = $return;
+                            $value = wp_kses( $return, $grid_kses_allowed );
                         }
                     } elseif ( $field['type'] == 'address_field' || is_serialized( $value ) ) {
                         // Security fix: Prevent PHP Object Injection by restricting allowed classes
@@ -373,16 +389,15 @@ class="wpuf_' . $field['name'] . '_' . $this->form_id . '"
                             $value = implode( '<br> ', $serialized_value );
                         }
                     } elseif ( $field['type'] == 'signature_field' ) {
-                        $url   =  $value;
-
-                        if ( isset( $_REQUEST['action'] ) != 'weforms_pdf_download' ) {
-                            $url   = content_url() . '/' . $value;
+                        if ( ! isset( $_REQUEST['action'] ) || $_REQUEST['action'] !== 'weforms_pdf_download' ) {
+                            $url   = esc_url( content_url() . '/' . $value );
                             $value = sprintf( '<img src="%s">', $url );
                             $value .= sprintf( '<a style="margin-left: -200px" href="%s">Download</a>', $url );
-                        }
-                        else{
+                        } else {
+                            $url   = esc_url( $value );
                             $value = sprintf( '<img src="%s">', $url );
                         }
+                        $value = wp_kses_post( $value );
                     }
 
                     $this->fields[ $result->meta_key ]['value'] = apply_filters( 'weforms_entry_meta_field', $value, $field );
diff --git a/includes/class-form.php b/includes/class-form.php
index b488f2b..d856474 100644
--- a/includes/class-form.php
+++ b/includes/class-form.php
@@ -433,7 +433,6 @@ public function maybe_update_entries( $form_fields ) {
     public function get_changed_fields( $form_fields ) {
         $changed_fields = array();
         foreach ( $form_fields as $field ) {
-            $org_field = $field['original_name'];
             // All form fields should have an original name.
             if ( empty( $field['original_name'] ) ) {
                 continue;
diff --git a/includes/class-notification.php b/includes/class-notification.php
index a1256e5..0367b5d 100644
--- a/includes/class-notification.php
+++ b/includes/class-notification.php
@@ -602,6 +602,7 @@ public static function replace_name_tag( $text, $entry_id ) {
      * @return string
      */
     public static function replace_file_tags( $text, $entry_id ) {
+        $text    = $text ?? '';
         $pattern = '/{(?:image|file):(\w*)}/';
 
         preg_match_all( $pattern, $text, $matches );
@@ -614,17 +615,10 @@ public static function replace_file_tags( $text, $entry_id ) {
         foreach ( $matches[1] as $index => $meta_key ) {
             $meta_value = weforms_get_entry_meta( $entry_id, $meta_key, true );
 
-            $files = [];
+            $files       = [];
+            $attachments = is_array( $meta_value ) ? $meta_value : array( $meta_value );
 
-            if ( is_array( $meta_value ) ) {
-                foreach ( $meta_value as $key => $attachment_id ) {
-                    $file_url = wp_get_attachment_url( $attachment_id );
-
-                    if ( $file_url ) {
-                        $files[] = $file_url;
-                    }
-                }
-            } else {
+            foreach ( $attachments as $attachment_id ) {
                 $file_url = wp_get_attachment_url( $attachment_id );
 
                 if ( $file_url ) {
diff --git a/includes/fields/class-abstract-fields.php b/includes/fields/class-abstract-fields.php
index ef6ffd6..30852b0 100644
--- a/includes/fields/class-abstract-fields.php
+++ b/includes/fields/class-abstract-fields.php
@@ -531,21 +531,32 @@ public function conditional_logic( $form_field, $form_id ) {
      * @return mixed
      */
     public function prepare_entry( $field, $args = [] ) {
-        if( empty( $_POST['_wpnonce'] ) ) {
-             wp_send_json_error( __( 'Unauthorized operation', 'weforms' ) );
+        if ( $args instanceof WP_REST_Request ) {
+            $nonce = $args->get_param( '_wpnonce' );
+        } else {
+            $nonce = isset( $_POST['_wpnonce'] ) ? $_POST['_wpnonce'] : '';
+        }
+
+        if ( empty( $nonce ) ) {
+            wp_send_json_error( __( 'Unauthorized operation', 'weforms' ) );
         }
 
-        if ( ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_POST['_wpnonce'] ) ), 'wpuf_form_add' ) ) {
+        if ( ! wp_verify_nonce( sanitize_text_field( wp_unslash( $nonce ) ), 'wpuf_form_add' ) ) {
             wp_send_json_error( __( 'Unauthorized operation', 'weforms' ) );
         }
 
-        $args  = ! empty( $args ) ? $args : weforms_clean( $_POST );
-        $value = !empty( $args[$field['name']] ) ? $args[$field['name']] : '';
+        if ( $args instanceof WP_REST_Request ) {
+            $args = weforms_clean( $args->get_params() );
+        } elseif ( empty( $args ) ) {
+            $args = weforms_clean( $_POST );
+        }
+
+        $value = ! empty( $args[ $field['name'] ] ) ? $args[ $field['name'] ] : '';
 
         if ( is_array( $value ) ) {
-            $entry_value = implode( WeForms::$field_separator, $args[$field['name']] );
+            $entry_value = implode( WeForms::$field_separator, $value );
         } else {
-            $entry_value = trim( $value  );
+            $entry_value = sanitize_textarea_field( trim( $value ) );
         }
 
         return $entry_value;
diff --git a/includes/functions.php b/includes/functions.php
index 6a8eab8..bb06dc0 100644
--- a/includes/functions.php
+++ b/includes/functions.php
@@ -621,7 +621,7 @@ function weforms_get_form_field_labels( $form_id ) {
         }
 
         $data[ $field['name'] ] = [
-            'label' => $field['label'],
+            'label' => $field['label'] ?? '',
             'type'  => $field['template'],
         ];
     }
@@ -715,6 +715,7 @@ function weforms_get_browser() {
     $bname    = 'Unknown';
     $platform = 'Unknown';
     $version  = '';
+    $ub       = '';
 
     // first get the platform
     if ( preg_match( '/linux/i', $u_agent ) ) {
diff --git a/package.json b/package.json
index b067070..eed7df9 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "weForms",
   "author": "BoldGrid",
-  "version": "1.6.27",
+  "version": "1.6.28",
   "license": "GPL-2.0",
   "repository": {
     "type": "git",
diff --git a/readme.txt b/readme.txt
index a95b0d1..3b356ee 100644
--- a/readme.txt
+++ b/readme.txt
@@ -4,7 +4,7 @@ Tags: form builder, contact form, forms, form creator, custom form
 Requires at least: 5.0
 Requires PHP: 7.2.5
 Tested up to: 6.9
-Stable tag: 1.6.27
+Stable tag: 1.6.28
 License: GPLv2 or later
 License URI: https://www.gnu.org/licenses/gpl-2.0.html
 
@@ -240,6 +240,12 @@ Please report security bugs found in the source code of the undefined plugin thr
 
 == Changelog ==
 
+= Version 1.6.28 ( 27 February, 2026 ) =
+* Security: Patched stored XSS vulnerability in form entry fields.
+
+= Version 1.6.27 ( 09 February, 2026 ) =
+* Security: Patched object injection vulnerability.
+
 = Version 1.6.26 ( 17 December, 2025 ) =
 * Fix: Added extra validation for form uploads.
 
diff --git a/weforms.php b/weforms.php
index cf5eb81..dde519b 100644
--- a/weforms.php
+++ b/weforms.php
@@ -5,7 +5,7 @@
  * Plugin URI: https://weformspro.com/
  * Author: weForms
  * Author URI: https://weformspro.com/
- * Version: 1.6.27
+ * Version: 1.6.28
  * License: GPL2 or later
  * License URI: https://www.gnu.org/licenses/gpl-2.0.html
  * Text Domain: weforms
@@ -55,7 +55,7 @@ final class WeForms {
      *
      * @var string
      */
-    public $version = '1.6.27';
+    public $version = '1.6.28';
 
     /**
      * Form field value seperator