diff --git a/Lib/Appsero/License.php b/Lib/Appsero/License.php
index e72ceb765..65e769d8f 100644
--- a/Lib/Appsero/License.php
+++ b/Lib/Appsero/License.php
@@ -272,7 +272,7 @@ public function menu_output() {
 
                 <div class="appsero-license-details">
                     <p>
-                        <?php printf( wp_kses_post( $this->client->__trans( 'Activate <strong>%s</strong> by your license key to get professional support and automatic update from your WordPress dashboard.' ) ), $this->client->name ); ?>
+                        <?php printf( wp_kses_post( $this->client->__trans( 'Activate <strong>%s</strong> by your license key to get professional support and automatic update from your WordPress dashboard.' ) ), esc_html( $this->client->name ) ); ?>
                     </p>
                     <form method="post" novalidate="novalidate" spellcheck="false">
                         <input type="hidden" name="_action" value="<?php echo esc_attr( $action ); ?>">
diff --git a/Lib/Gateway/Bank.php b/Lib/Gateway/Bank.php
index 0dd6eaaaa..814b24c7e 100644
--- a/Lib/Gateway/Bank.php
+++ b/Lib/Gateway/Bank.php
@@ -124,6 +124,7 @@ public function order_notify_user( $transaction, $order_id ) {
         $msg     = sprintf(
             // translators: %s is displayname
             __( 'Hello %s,', 'wp-user-frontend' ), $user->display_name ) . "\r\n";
+        // translators: %s is the payment amount
         $msg .= sprintf( __( 'We have received your payment amount of %s through bank . ', 'wp-user-frontend' ), $transaction['cost'] ) . "\r\n\r\n";
         $msg .= __( 'Thanks for being with us.', 'wp-user-frontend' ) . "\r\n";
 
diff --git a/Lib/Gateway/Paypal.php b/Lib/Gateway/Paypal.php
index 63256e04d..eb89d4ec2 100644
--- a/Lib/Gateway/Paypal.php
+++ b/Lib/Gateway/Paypal.php
@@ -129,7 +129,7 @@ public function paypal_settings_update_notice() {
                     type: 'POST',
                     data: {
                         action: 'wpuf_dismiss_paypal_notice',
-                        nonce: '<?php echo wp_create_nonce( 'wpuf_dismiss_paypal_notice' ); ?>'
+                        nonce: '<?php echo esc_js( wp_create_nonce( 'wpuf_dismiss_paypal_notice' ) ); ?>'
                     },
                     success: function(response) {
                         // Handle success if needed
@@ -465,7 +465,7 @@ public function handle_webhook_request() {
 
                 $acknowledged = true;
             } catch ( \Exception $e ) {
-               throw new \Exception( 'Webhook processing failed: ' . $e->getMessage() );
+               throw new \Exception( 'Webhook processing failed: ' . esc_html( $e->getMessage() ) );
             }
 
             // Always acknowledge to PayPal
@@ -1522,7 +1522,7 @@ function( $hosts ) {
                 exit();
             }
         } catch ( \Exception $e ) {
-            wp_die( $e->getMessage() );
+            wp_die( esc_html( $e->getMessage() ) );
         }
     }
 
@@ -2066,7 +2066,7 @@ private function handle_subscription_activated( $subscription ) {
                 }
             }
         } catch ( \Exception $e ) {
-            throw new \Exception( 'Error handling subscription activation: ' . $e->getMessage() );
+            throw new \Exception( 'Error handling subscription activation: ' . esc_html( $e->getMessage() ) );
         }
     }
 }
diff --git a/Lib/invisible_recaptcha.php b/Lib/invisible_recaptcha.php
index a59784041..f200ef644 100644
--- a/Lib/invisible_recaptcha.php
+++ b/Lib/invisible_recaptcha.php
@@ -24,7 +24,7 @@ public function __construct( $site_key, $secret_key ){
 
 		if ( $secret_key == null || $secret_key == "" ) {
             die("To use reCAPTCHA you must get an API key from <a href='"
-                . self::$_signupUrl . "'>" . self::$_signupUrl . "</a>");
+                . esc_url( self::$_signupUrl ) . "'>" . esc_html( self::$_signupUrl ) . "</a>");
         }
         $this->config = array(
 			'client-key' => $site_key,
diff --git a/Lib/recaptchalib.php b/Lib/recaptchalib.php
index 1c83263a9..143b895ce 100644
--- a/Lib/recaptchalib.php
+++ b/Lib/recaptchalib.php
@@ -122,9 +122,27 @@ function recaptcha_get_html ($pubkey, $enable_no_captcha = false, $error = null,
 
 
     if ( $enable_no_captcha == true ) {
-        $return_var =  '<div class="g-recaptcha" data-sitekey="'.$pubkey.'"></div><script src="https://www.google.com/recaptcha/api.js"></script>';
+        wp_enqueue_script( 'wpuf-recaptcha', 'https://www.google.com/recaptcha/api.js', array(), null, true );
+        $return_var =  '<div class="g-recaptcha" data-sitekey="'.esc_attr($pubkey).'"></div>';
     } else {
-        $return_var = '<script type="text/javascript" src="'. $server . '/challenge?k=' . $pubkey . $errorpart . '"></script>';
+        wp_enqueue_script( 'wpuf-recaptcha-legacy', $server . '/challenge?k=' . $pubkey . $errorpart, array(), null, true );
+        $container_id = 'wpuf-recaptcha-legacy-' . uniqid();
+        $return_var = '<div id="' . esc_attr($container_id) . '" class="wpuf-recaptcha-legacy-container"></div>
+<script>
+(function() {
+    var container = document.getElementById("' . esc_js($container_id) . '");
+    if (container) {
+        var originalWrite = document.write;
+        document.write = function(content) {
+            container.innerHTML = content;
+        };
+        // Reset document.write after a short delay to avoid interfering with other scripts
+        setTimeout(function() {
+            document.write = originalWrite;
+        }, 100);
+    }
+})();
+</script>';
     }
 
         return $return_var.'
diff --git a/Lib/recaptchalib_noCaptcha.php b/Lib/recaptchalib_noCaptcha.php
index 07c67c77c..cf7c31ac1 100644
--- a/Lib/recaptchalib_noCaptcha.php
+++ b/Lib/recaptchalib_noCaptcha.php
@@ -58,7 +58,7 @@ function __construct($secret)
     {
         if ($secret == null || $secret == "") {
             die("To use reCAPTCHA you must get an API key from <a href='"
-                . self::$_signupUrl . "'>" . self::$_signupUrl . "</a>");
+                . esc_url( self::$_signupUrl ) . "'>" . esc_html( self::$_signupUrl ) . "</a>");
         }
         $this->_secret=$secret;
     }
@@ -95,35 +95,27 @@ private function _submitHTTPGet($path, $data)
         $req = $this->_encodeQS($data);
         $url = $path . $req;
 
-        // Use curl if possible because allow_url_fopen is off in many
-        // environments, making file_get_contents fail.
-        if (function_exists('curl_init')) {
-            $response = $this->_curl($url);
-        } else {
-            $response = file_get_contents($url);
+        // Use WordPress HTTP API instead of cURL
+        $response = wp_remote_get($url, array(
+            'timeout' => 3,
+            'sslverify' => true
+        ));
+        
+        if (is_wp_error($response)) {
+            return false;
+        }
+        
+        $response_code = wp_remote_retrieve_response_code($response);
+        $response_body = wp_remote_retrieve_body($response);
+        
+        // Return false for non-200 responses or empty bodies
+        if ($response_code !== 200 || empty($response_body)) {
+            return false;
         }
-        return $response;
+        
+        return $response_body;
     }
 
-    private function _curl($url)
-    {
-        // Initiate curl.
-        $c = curl_init();
-        // Set timeout.
-        $timeout = 3;
-        curl_setopt($c, CURLOPT_CONNECTTIMEOUT, $timeout);
-        curl_setopt($c, CURLOPT_RETURNTRANSFER, TRUE);
-        // Set url for call.
-        curl_setopt($c, CURLOPT_URL, $url);
-
-        // Execute curl call.
-        $response = curl_exec($c);
-
-        // Close curl.
-        curl_close($c);
-
-        return $response;
-    }
 
     /**
      * Calls the reCAPTCHA siteverify API to verify whether the user passes
diff --git a/admin/form-builder/assets/js/components/builder-stage-v4-1/template.php b/admin/form-builder/assets/js/components/builder-stage-v4-1/template.php
index 0399eeaff..c10282235 100644
--- a/admin/form-builder/assets/js/components/builder-stage-v4-1/template.php
+++ b/admin/form-builder/assets/js/components/builder-stage-v4-1/template.php
@@ -1,6 +1,6 @@
 <div id="form-preview-stage" class="wpuf-h-[70vh]">
     <div v-if="!form_fields.length" class="wpuf-flex wpuf-flex-col wpuf-items-center wpuf-justify-center wpuf-h-[80vh]">
-        <img src="<?php echo WPUF_ASSET_URI . '/images/form-blank-state.svg'; ?>" alt="">
+        <img src="<?php echo esc_url( WPUF_ASSET_URI . '/images/form-blank-state.svg' ); ?>" alt="">
         <h2 class="wpuf-text-lg wpuf-text-gray-800 wpuf-mt-8 wpuf-mb-2"><?php esc_html_e( 'Add fields and build your desired form', 'wp-user-frontend' ); ?></h2>
 
         <p class="wpuf-text-sm wpuf-text-gray-500"><?php esc_html_e( 'Add the necessary field and build your form.', 'wp-user-frontend' ); ?></p>
@@ -49,7 +49,7 @@ class="wpuf-relative"
                         <label class="wpuf-pro-text-alert">
                             <a :href="pro_link" target="_blank"
                                class="wpuf-text-gray-700 wpuf-text-base"><strong>{{ get_field_name( field.template )
-                                    }}</strong> <?php _e( 'is available in Pro Version', 'wp-user-frontend' ); ?></a>
+                                    }}</strong> <?php esc_html_e( 'is available in Pro Version', 'wp-user-frontend' ); ?></a>
                         </label>
                     </div>
                 </div>
@@ -111,7 +111,7 @@ class="fa fa-clone control-button-disabled wpuf--ml-1"></i>
                                 :href="pro_link"
                                 target="_blank"
                                 class="wpuf-rounded-r-md hover:wpuf-bg-slate-500 hover:wpuf-cursor-pointer wpuf-transition wpuf-duration-150 wpuf-ease-out hover:wpuf-transition-all">
-                                <img src="<?php esc_attr_e( WPUF_ASSET_URI . '/images/pro-badge.svg' ); ?>" alt="">
+                                <img src="<?php echo esc_attr( WPUF_ASSET_URI . '/images/pro-badge.svg' ); ?>" alt="">
                             </a>
                         </span>
                 </div>
diff --git a/admin/form-builder/assets/js/components/field-option-pro-feature-alert/template.php b/admin/form-builder/assets/js/components/field-option-pro-feature-alert/template.php
index 30f167af1..25f5c4ae6 100644
--- a/admin/form-builder/assets/js/components/field-option-pro-feature-alert/template.php
+++ b/admin/form-builder/assets/js/components/field-option-pro-feature-alert/template.php
@@ -3,6 +3,6 @@
     <label
         class="wpuf-pro-text-alert wpuf-ml-2 wpuf-tooltip-top"
         data-tip="<?php esc_attr_e( 'Available in PRO version', 'wp-user-frontend' ); ?>">
-        <a :href="pro_link" target="_blank"><img src="<?php echo wpuf_get_pro_icon() ?>" alt="pro icon"></a>
+        <a :href="pro_link" target="_blank"><img src="<?php echo esc_url( wpuf_get_pro_icon() ) ?>" alt="pro icon"></a>
     </label>
 </div>
diff --git a/admin/form-builder/assets/js/components/field-visibility/template.php b/admin/form-builder/assets/js/components/field-visibility/template.php
index 5c62f4ce9..b69f583f0 100644
--- a/admin/form-builder/assets/js/components/field-visibility/template.php
+++ b/admin/form-builder/assets/js/components/field-visibility/template.php
@@ -81,7 +81,7 @@ class="wpuf-block wpuf-my-1 wpuf-mr-2 wpuf-font-medium wpuf-text-gray-900">
                         $partially_filtered = preg_replace('/(<input[^>]+)/', '$1 ' . $attr, $partially_filtered, 1);
                     }
 
-                    echo $partially_filtered;
+                    echo esc_html( $partially_filtered );
                 }
             ?>
 	    </ul>
@@ -129,7 +129,7 @@ class="wpuf-block wpuf-my-1 wpuf-mr-2 wpuf-font-medium wpuf-text-gray-900">
                                 $partially_filtered = preg_replace('/(<input[^>]+)/', '$1 ' . $attr, $partially_filtered, 1);
                             }
 
-                            echo $partially_filtered;
+                            echo esc_html( $partially_filtered );
                         }
                     } else {
                         esc_html_e( 'No subscription plan found.', 'wp-user-frontend' );
diff --git a/admin/form-builder/assets/js/components/form-column_field/template.php b/admin/form-builder/assets/js/components/form-column_field/template.php
index 0a499cc0b..63fdef2f6 100644
--- a/admin/form-builder/assets/js/components/form-column_field/template.php
+++ b/admin/form-builder/assets/js/components/form-column_field/template.php
@@ -105,7 +105,7 @@ class="hover:wpuf-bg-green-700">
                                 :href="pro_link"
                                 target="_blank"
                                 class="wpuf-rounded-r-md hover:wpuf-bg-slate-500 hover:wpuf-cursor-pointer wpuf-transition wpuf-duration-150 wpuf-ease-out hover:wpuf-transition-all">
-                                <img src="<?php esc_attr_e( WPUF_ASSET_URI . '/images/pro-badge.svg' ); ?>" alt="">
+                                <img src="<?php echo esc_attr( WPUF_ASSET_URI . '/images/pro-badge.svg' ); ?>" alt="">
                             </a>
                         </span>
                         </div>
diff --git a/admin/form-builder/assets/js/components/form-fields-v4-1/template.php b/admin/form-builder/assets/js/components/form-fields-v4-1/template.php
index a1f9bd188..0b6d8f5e3 100644
--- a/admin/form-builder/assets/js/components/form-fields-v4-1/template.php
+++ b/admin/form-builder/assets/js/components/form-fields-v4-1/template.php
@@ -73,7 +73,7 @@ class="wpuf-shrink-0 wpuf-mr-2 wpuf-text-gray-400">
                                 </div>
                             <div
                                 class="wpuf-absolute wpuf-top-4 wpuf-right-4 wpuf-opacity-0 group-hover/pro-field:wpuf-opacity-100 wpuf-transition-all">
-                                <img src="<?php esc_attr_e( WPUF_ASSET_URI . '/images/pro-badge.svg' ); ?>" alt="">
+                                <img src="<?php echo esc_attr( WPUF_ASSET_URI . '/images/pro-badge.svg' ); ?>" alt="">
                             </div>
                         </div>
                         <div
diff --git a/admin/form-builder/views/form-builder-v4.1.php b/admin/form-builder/views/form-builder-v4.1.php
index f32ead725..2cdbe711b 100644
--- a/admin/form-builder/views/form-builder-v4.1.php
+++ b/admin/form-builder/views/form-builder-v4.1.php
@@ -5,7 +5,7 @@ class="!wpuf-bg-white !wpuf-static !wpuf-w-[calc(100%+20px)] wpuf-ml-[-20px] !wp
     <div class="wpuf-bg-white wpuf-p-8 wpuf-justify-between wpuf-items-center wpuf-pb-7">
         <div class="wpuf-flex wpuf-justify-between">
             <div class="wpuf-flex">
-                <img src="<?php echo WPUF_ASSET_URI . '/images/wpuf-icon-circle.svg'; ?>" alt="WPUF Icon" class="wpuf-mr-2">
+                <img src="<?php echo esc_url( WPUF_ASSET_URI . '/images/wpuf-icon-circle.svg' ); ?>" alt="WPUF Icon" class="wpuf-mr-2">
                 <nav class="wpuf-flex wpuf-items-center" aria-label="Tabs">
                     <div class="wpuf-relative wpuf-flex">
                         <div class="wpuf-flex wpuf-items-center">
@@ -55,11 +55,16 @@ class="form-switcher-arrow !wpuf-font-bold !wpuf-text-xl !wpuf-leading-none"
 
                 if ( count( $shortcodes ) > 1 && isset( $shortcodes[0]['type'] ) ) {
                     foreach ( $shortcodes as $shortcode ) {
+                        ?>
+                        <?php
+                        // translators: %s is the shortcode type (e.g., form, post, profile)
+                        $title = sprintf( __( 'Click to copy %s shortcode', 'wp-user-frontend' ), esc_attr( $shortcode['type'] ) );
+                        $clipboard = sprintf( '[%s type="%s" id="%s"]', $shortcode['name'], esc_attr( $shortcode['type'] ), esc_attr( $form_id ) );
                         ?>
                         <span
                             class="form-id wpuf-group wpuf-flex wpuf-items-center wpuf-px-[18px] wpuf-py-[10px] wpuf-rounded-md wpuf-border wpuf-border-gray-300 hover:wpuf-cursor-pointer wpuf-ml-6 wpuf-text-gray-700 wpuf-text-base wpuf-leading-none wpuf-shadow-sm"
-                            title="<?php printf( esc_attr( __( 'Click to copy %s shortcode', 'wp-user-frontend' ) ), $shortcode['type'] ); ?>"
-                            data-clipboard-text="<?php printf( esc_attr( '[' . $shortcode['name'] . ' type="' . esc_attr( $shortcode['type'] ) . '" id="' . esc_attr( $form_id ) . '"]' ) ); ?>"><?php echo esc_attr( ucwords( $shortcode['type'] ) ); ?>: #{{ post.ID }}
+                            title="<?php echo esc_attr( $title ); ?>"
+                            data-clipboard-text="<?php echo esc_attr( $clipboard ); ?>"><?php echo esc_attr( ucwords( $shortcode['type'] ) ); ?>: #{{ post.ID }}
                             <span id="default-icon" class="wpuf-ml-2">
                                 <svg
                                     class="group-hover:wpuf-rotate-6 group-hover:wpuf-stroke-gray-500 wpuf-stroke-gray-400"
@@ -106,7 +111,7 @@ class="wpuf-rotate-6 !wpuf-stroke-primary wpuf-mt-[-5px]"
             </div>
             <div class="wpuf-flex wpuf-space-x-4">
                 <a
-                    :href="'<?php echo get_wpuf_preview_page(); ?>?wpuf_preview=1&form_id=' + post.ID"
+                    :href="'<?php echo esc_url( get_wpuf_preview_page() ); ?>?wpuf_preview=1&form_id=' + post.ID"
                     target="_blank"
                     class="wpuf-inline-flex wpuf-items-center wpuf-gap-x-3 wpuf-rounded-md wpuf-px-[18px] wpuf-py-[10px] wpuf-text-base wpuf-text-gray-700  hover:wpuf-text-gray-700 hover:wpuf-bg-gray-50 wpuf-ring-1 wpuf-ring-inset wpuf-ring-gray-300 focus:wpuf-shadow-none focus:wpuf-border-none wpuf-leading-none wpuf-shadow-sm"><?php esc_html_e( 'Preview', 'wp-user-frontend' ); ?>
                     <svg width="20" height="14" viewBox="0 0 20 14" fill="none" xmlns="http://www.w3.org/2000/svg">
diff --git a/admin/form-builder/views/post-form-settings.php b/admin/form-builder/views/post-form-settings.php
index 36f8a4e73..1919130bf 100644
--- a/admin/form-builder/views/post-form-settings.php
+++ b/admin/form-builder/views/post-form-settings.php
@@ -26,11 +26,11 @@
                     :class="active_settings_tab === 'modules'? 'wpuf-bg-primary active_settings_tab wpuf-m-0 wpuf-text-white' : ''"
                     class="wpuf-group/sidebar-item hover:wpuf-bg-primary hover:wpuf-cursor-pointer hover:wpuf-text-white wpuf-rounded-lg wpuf-transition-all wpuf-duration-200 wpuf-ease-in-out wpuf-items-center wpuf-w-full wpuf-m-0 wpuf-py-2 wpuf-px-3 wpuf--ml-3 wpuf-flex wpuf-text-gray-600">
                     <?php
-                    echo $icon;
+                    echo wp_kses( $icon, array('span' => array('class' => array()), 'i' => array('class' => array())) );
                     ?>
                     <span class="wpuf-ml-2">
                         <?php
-                        echo $label;
+                        echo esc_html( $label );
                         ?>
                     </span>
                 </h2>
@@ -39,11 +39,11 @@ class="wpuf-group/sidebar-item hover:wpuf-bg-primary hover:wpuf-cursor-pointer h
                 <div class="wpuf-mb-4 wpuf-flex wpuf-justify-between wpuf-items-center">
                     <h2 class="wpuf-text-base wpuf-text-gray-600 wpuf-m-0 wpuf-flex wpuf-items-center">
                         <?php
-                        echo $icon;
+                        echo wp_kses( $icon, array('span' => array('class' => array()), 'i' => array('class' => array())) );
                         ?>
                         <span class="wpuf-ml-2">
                 <?php
-                echo $label;
+                echo esc_html( $label );
                 ?>
                 </span>
                     </h2>
@@ -61,26 +61,26 @@ class="wpuf-group/sidebar-item hover:wpuf-bg-primary hover:wpuf-cursor-pointer h
                             $sub_label = ! empty( $sub_menu['label'] ) ? $sub_menu['label'] : '';
                             ?>
                             <li
-                                @click="switch_settings_menu('<?php echo $key; ?>', '<?php echo $sub_key; ?>')"
-                                :class="active_settings_tab === '<?php echo $sub_key; ?>' ? 'wpuf-bg-primary active_settings_tab' : ''"
+                                @click="switch_settings_menu('<?php echo esc_attr( $key ); ?>', '<?php echo esc_attr( $sub_key ); ?>')"
+                                :class="active_settings_tab === '<?php echo esc_attr( $sub_key ); ?>' ? 'wpuf-bg-primary active_settings_tab' : ''"
                                 class="wpuf-group/sidebar-item wpuf-mx-2 wpuf-py-2 wpuf-px-3 hover:wpuf-bg-primary hover:wpuf-cursor-pointer wpuf-rounded-lg wpuf-transition-all wpuf-duration-200 wpuf-ease-in-out wpuf-items-center wpuf-flex wpuf-justify-between"
-                                data-settings="<?php echo $sub_key; ?>">
+                                data-settings="<?php echo esc_attr( $sub_key ); ?>">
                                 <a
-                                    :class="active_settings_tab === '<?php echo $sub_key; ?>' ? 'wpuf-text-white' : 'wpuf-text-gray-600'"
+                                    :class="active_settings_tab === '<?php echo esc_attr( $sub_key ); ?>' ? 'wpuf-text-white' : 'wpuf-text-gray-600'"
                                     class="wpuf-ml-2 wpuf-text-sm group-hover/sidebar-item:wpuf-text-white wpuf-transition-all wpuf-duration-200 wpuf-ease-in-out focus:wpuf-shadow-none focus:wpuf-outline-none wpuf-flex wpuf-items-center">
                                     <?php
-                                    echo $sub_icon;
+                                    echo wp_kses( $sub_icon, array('span' => array('class' => array()), 'i' => array('class' => array())) );
                                     ?>
                                     <span class="wpuf-ml-2">
                                         <?php
-                                        echo $sub_label;
+                                        echo esc_html( $sub_label );
                                         ?>
                                     </span>
                                 </a>
                                 <?php
                                 if ( in_array( $sub_key, $badge_menus, true ) && ! wpuf_is_pro_active() ) {
                                     ?>
-                                    <span><img src="<?php echo wpuf_get_pro_icon() ?>" alt="pro icon"></span>
+                                    <span><img src="<?php echo esc_url( wpuf_get_pro_icon() ) ?>" alt="pro icon"></span>
                                     <?php
                                 }
                                 ?>
@@ -125,11 +125,11 @@ class="wpuf-ml-2 wpuf-text-sm group-hover/sidebar-item:wpuf-text-white wpuf-tran
                         }
                         ?>
                     <div
-                        class="<?php echo $class_list; ?>"
-                        data-settings-body="<?php echo $settings_key; ?>"
+                        class="<?php echo esc_attr( $class_list ); ?>"
+                        data-settings-body="<?php echo esc_attr( $settings_key ); ?>"
                     >
-                        <p class="wpuf-text-lg wpuf-font-medium wpuf-mb-3 wpuf-mt-0 wpuf-leading-none"><?php echo $section['label']; ?></p>
-                        <p class="wpuf-text-gray-500 wpuf-text-[13px] wpuf-leading-5 !wpuf-mb-4 !wpuf-mt-0"><?php echo $section['desc']; ?></p>
+                        <p class="wpuf-text-lg wpuf-font-medium wpuf-mb-3 wpuf-mt-0 wpuf-leading-none"><?php echo esc_html( $section['label'] ); ?></p>
+                        <p class="wpuf-text-gray-500 wpuf-text-[13px] wpuf-leading-5 !wpuf-mb-4 !wpuf-mt-0"><?php echo esc_html( $section['desc'] ); ?></p>
                         <?php
                         if ( ! empty( $section['fields'] ) ) {
                             foreach ( $section['fields'] as $field_key => $field ) {
@@ -166,7 +166,7 @@ class="wpuf-btn-primary wpuf-absolute wpuf-top-[50%] wpuf-left-[50%] wpuf--trans
                     ?>
                 <div
                     class="wpuf-settings-body wpuf--mt-6"
-                    data-settings-body="<?php echo $settings_key; ?>"
+                    data-settings-body="<?php echo esc_attr( $settings_key ); ?>"
                 >
                     <?php
                     foreach ( $settings_item as $field_key => $field ) {
@@ -346,24 +346,24 @@ function wpuf_render_settings_field( $field_key, $field, $form_settings, $post_t
                     <input
                         :class="[setting_class_names('checkbox'), '!wpuf-mr-2']"
                         type="checkbox"
-                        name="<?php echo $is_pro_preview ? '' : $name; ?>"
+                        name="<?php echo $is_pro_preview ? '' : esc_attr( $name ); ?>"
                         <?php echo esc_attr( checked( $value, 'on', false ) ); ?>
                         <?php echo $is_pro_preview ? 'disabled' : ''; ?>
-                        id="<?php echo $field_key; ?>"/>
+                        id="<?php echo esc_attr( $field_key ); ?>"/>
                 <?php } ?>
                 <?php
                 if ( 'color-picker' === $field['type'] || 'toggle' === $field['type'] ) {
                     echo '<div class="wpuf-flex wpuf-items-center">';
                 }
                 ?>
-                <label for="<?php echo $field_key; ?>" class="wpuf-text-sm wpuf-text-gray-700 wpuf-my-2">
-                    <?php echo $field['label']; ?>
+                <label for="<?php echo esc_attr( $field_key ); ?>" class="wpuf-text-sm wpuf-text-gray-700 wpuf-my-2">
+                    <?php echo esc_html( $field['label'] ); ?>
                 </label>
                 <?php if ( ! empty( $field['help_text'] ) ) { ?>
-                    <help-text text="<?php echo $field['help_text']; ?>"></help-text>
+                    <help-text text="<?php echo esc_attr( $field['help_text'] ); ?>"></help-text>
                 <?php } ?>
                 <?php if ( ! empty( $field['link'] ) ) { ?>
-                    <a href="<?php echo $field['link']; ?>" target="_blank" title="<?php esc_attr_e( 'Learn More', 'wp-user-frontend' ); ?>" class="focus:wpuf-shadow-none">
+                    <a href="<?php echo esc_url( $field['link'] ); ?>" target="_blank" title="<?php esc_attr_e( 'Learn More', 'wp-user-frontend' ); ?>" class="focus:wpuf-shadow-none">
                         <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 20 20" class="wpuf-size-5 wpuf-ml-1 wpuf-stroke-gray-50 hover:wpuf-stroke-gray-200">
                             <path d="M12.232 4.232a2.5 2.5 0 0 1 3.536 3.536l-1.225 1.224a.75.75 0 0 0 1.061 1.06l1.224-1.224a4 4 0 0 0-5.656-5.656l-3 3a4 4 0 0 0 .225 5.865.75.75 0 0 0 .977-1.138 2.5 2.5 0 0 1-.142-3.667l3-3Z" />
                             <path d="M11.603 7.963a.75.75 0 0 0-.977 1.138 2.5 2.5 0 0 1 .142 3.667l-3 3a2.5 2.5 0 0 1-3.536-3.536l1.225-1.224a.75.75 0 0 0-1.061-1.06l-1.224 1.224a4 4 0 1 0 5.656 5.656l3-3a4 4 0 0 0-.225-5.865Z" />
@@ -390,12 +390,12 @@ function wpuf_render_settings_field( $field_key, $field, $form_settings, $post_t
                     }
                 ?>
                     <label
-                        for="<?php echo $field_key; ?>"
+                        for="<?php echo esc_attr( $field_key ); ?>"
                         class="wpuf-relative wpuf-inline-flex wpuf-items-center wpuf-cursor-pointer wpuf-ml-2">
                         <input
                             type="checkbox"
-                            id="<?php echo $field_key; ?>"
-                            name="<?php echo $is_pro_preview ? '' : $name; ?>"
+                            id="<?php echo esc_attr( $field_key ); ?>"
+                            name="<?php echo $is_pro_preview ? '' : esc_attr( $name ); ?>"
                             <?php echo esc_attr( checked( $toggle_value, 'on', false ) ); ?>
                             <?php echo $is_pro_preview ? 'disabled' : ''; ?>
                             class="wpuf-sr-only wpuf-peer">
@@ -408,13 +408,17 @@ class="wpuf-sr-only wpuf-peer">
                             @click="$event.target.querySelector('input').click()"
                             class="wpuf-flex wpuf-justify-center wpuf-items-center wpuf-space-x-1 wpuf-px-2 wpuf-py-1.5 wpuf-rounded-md wpuf-bg-white wpuf-border wpuf-cursor-pointer wpuf-relative">
                             <div class="wpuf-w-6 wpuf-h-6 wpuf-overflow-hidden wpuf-border wpuf-border-gray-200 wpuf-rounded-full wpuf-flex wpuf-justify-center wpuf-items-center">
+                                <?php
+                                $sanitized_default = sanitize_hex_color( $field['default'] ) ?: '';
+                                $sanitized_value = sanitize_hex_color( $value ) ?: '';
+                                ?>
                                 <input
                                     type="color"
                                     class="wpuf-w-8 wpuf-h-12 !wpuf-border-gray-50 !wpuf--m-4 hover:!wpuf-cursor-pointer"
-                                    name="<?php echo $name; ?>"
-                                    id="<?php echo $field_key; ?>"
-                                    style="background: <?php echo $field['default']; ?>"
-                                    value="<?php echo $value; ?>">
+                                    name="<?php echo esc_attr( $name ); ?>"
+                                    id="<?php echo esc_attr( $field_key ); ?>"
+                                    style="background: <?php echo esc_attr( $sanitized_default ); ?>"
+                                    value="<?php echo esc_attr( $sanitized_value ); ?>">
                             </div>
                             <i
                                 @click="$event.target.closest('div').querySelector('input').click()"
@@ -428,13 +432,13 @@ class="fa fa-angle-down !wpuf-font-bold !wpuf-text-xl !wpuf-leading-none wpuf-te
                 $value_str = is_array( $value ) ? implode( ',', $value ) : $value;
                 ?>
                 <select
-                    id="<?php echo $field_key; ?>"
-                    name="<?php echo $name; ?>"
-                    data-value="<?php echo $value_str; ?>"
+                    id="<?php echo esc_attr( $field_key ); ?>"
+                    name="<?php echo esc_attr( $name ); ?>"
+                    data-value="<?php echo esc_attr( $value_str ); ?>"
                     :class="setting_class_names('dropdown')">
                     <?php
                     foreach ( $field['options'] as $index => $option ) {
-                        printf( '<option data-select-value="%s" data-select-index="%s" value="%s"%s>%s</option>', $value, $index, esc_attr( $index ), esc_attr( selected( $value, $index, false ) ), esc_html( $option ) );
+                        printf( '<option data-select-value="%s" data-select-index="%s" value="%s"%s>%s</option>', esc_attr( $value_str ), esc_attr( $index ), esc_attr( $index ), esc_attr( selected( $value, $index, false ) ), esc_html( $option ) );
                     }
                     ?>
                 </select>
@@ -444,9 +448,9 @@ class="fa fa-angle-down !wpuf-font-bold !wpuf-text-xl !wpuf-leading-none wpuf-te
                 $value_str = is_array( $value ) ? implode( ',', $value ) : $value;
                 ?>
                 <select
-                    id="<?php echo $field_key; ?>"
-                    name="<?php echo $name; ?>[]"
-                    data-value="<?php echo $value_str; ?>"
+                    id="<?php echo esc_attr( $field_key ); ?>"
+                    name="<?php echo esc_attr( $name ); ?>[]"
+                    data-value="<?php echo esc_attr( $value_str ); ?>"
                     :class="setting_class_names('dropdown')"
                     multiple
                 >
@@ -457,7 +461,7 @@ class="fa fa-angle-down !wpuf-font-bold !wpuf-text-xl !wpuf-leading-none wpuf-te
                             $selected = in_array( $index, $value ) ? 'selected' : '';
 
                             printf(
-                                '<option value="%s" %s>%s</option>', esc_attr( $index ), $selected, esc_html( $option )
+                                '<option value="%s" %s>%s</option>', esc_attr( $index ), esc_attr( $selected ), esc_html( $option )
                             );
                         } else {
                             printf(
@@ -473,12 +477,12 @@ class="fa fa-angle-down !wpuf-font-bold !wpuf-text-xl !wpuf-leading-none wpuf-te
                 ?>
                 <input
                     :class="setting_class_names('text')"
-                    type="<?php echo $field['type']; ?>"
-                    name="<?php echo $is_pro_preview ? '' : $name; ?>"
-                    <?php echo ! empty( $field['placeholder'] ) ? 'placeholder=' . $field['placeholder'] : ''; ?>
+                    type="<?php echo esc_attr( $field['type'] ); ?>"
+                    name="<?php echo $is_pro_preview ? '' : esc_attr( $name ); ?>"
+                    <?php echo ! empty( $field['placeholder'] ) ? 'placeholder="' . esc_attr( $field['placeholder'] ) . '"' : ''; ?>
                     <?php echo $is_pro_preview ? 'disabled' : ''; ?>
-                    id="<?php echo $field_key; ?>"
-                    value="<?php echo $value; ?>"/>
+                    id="<?php echo esc_attr( $field_key ); ?>"
+                    value="<?php echo esc_attr( $value ); ?>"/>
             <?php } ?>
             <?php
             if ( 'textarea' === $field['type'] ) {
@@ -487,15 +491,15 @@ class="fa fa-angle-down !wpuf-font-bold !wpuf-text-xl !wpuf-leading-none wpuf-te
                 <textarea
                     :class="setting_class_names('textarea')"
                     rows="6"
-                    name="<?php echo $is_pro_preview ? '' : $name; ?>"
+                    name="<?php echo $is_pro_preview ? '' : esc_attr( $name ); ?>"
                     <?php echo $is_pro_preview ? 'disabled' : ''; ?>
-                    id="<?php echo $field_key; ?>"><?php echo $value; ?></textarea>
+                    id="<?php echo esc_attr( $field_key ); ?>"><?php echo esc_textarea( $value ); ?></textarea>
             <?php } ?>
 
             <?php
             if ( 'pic-radio' === $field['type'] ) {
                 ?>
-                <div class="wpuf-grid wpuf-grid-cols-4 wpuf-pic-radio" id="<?php echo $field_key; ?>">
+                <div class="wpuf-grid wpuf-grid-cols-4 wpuf-pic-radio" id="<?php echo esc_attr( $field_key ); ?>">
                     <?php
                     foreach ( $field['options'] as $key => $option ) {
                         ?>
@@ -503,22 +507,22 @@ class="fa fa-angle-down !wpuf-font-bold !wpuf-text-xl !wpuf-leading-none wpuf-te
                             <label>
                                 <input
                                     type="radio"
-                                    name="<?php echo $name; ?>"
-                                    value="<?php echo $key; ?>"
+                                    name="<?php echo esc_attr( $name ); ?>"
+                                    value="<?php echo esc_attr( $key ); ?>"
                                     <?php echo esc_attr( checked( $value, $key, false ) ); ?>
                                     class="wpuf-absolute wpuf-opacity-0 wpuf-peer">
                                 <img
                                     class="wpuf-absolute wpuf-opacity-0 peer-checked:wpuf-opacity-100 wpuf-top-[7%] wpuf-right-[12%] wpuf-transition-all wpuf-duration-200 wpuf-ease-in-out"
                                     src="<?php echo esc_attr( WPUF_ASSET_URI . '/images/checked-green.svg' ); ?>" alt="">
                                 <img
-                                    src="<?php echo $option['image']; ?>"
-                                    alt="<?php echo $key; ?>"
+                                    src="<?php echo esc_url( $option['image'] ); ?>"
+                                    alt="<?php echo esc_attr( $key ); ?>"
                                     class="hover:wpuf-cursor-pointer wpuf-border-transparent wpuf-border-2 wpuf-border-solid wpuf-rounded-lg hover:wpuf-border-primary peer-checked:wpuf-border-primary wpuf-transition-all wpuf-duration-200 wpuf-ease-in-out wpuf-mb-2 wpuf-w-full">
                             </label>
                             <label
-                                for="<?php echo $field_key; ?>"
+                                for="<?php echo esc_attr( $field_key ); ?>"
                                 class="wpuf-mr-2 wpuf-text-sm wpuf-text-gray-700">
-                                <?php echo $option['label']; ?>
+                                <?php echo esc_html( $option['label'] ); ?>
                         </div>
                         <?php
                     }
@@ -533,14 +537,14 @@ class="wpuf-mr-2 wpuf-text-sm wpuf-text-gray-700">
                 ?>
                 <div class="wpuf-relative">
                     <input
-                        :class="setting_class_names('<?php echo $field['trailing_type']; ?>')"
-                        type="<?php echo $field['trailing_type']; ?>"
-                        name="<?php echo $name; ?>"
-                        id="<?php echo $field_key; ?>"
-                        value="<?php echo $value; ?>"/>
+                        :class="setting_class_names('<?php echo esc_attr( $field['trailing_type'] ); ?>')"
+                        type="<?php echo esc_attr( $field['trailing_type'] ); ?>"
+                        name="<?php echo esc_attr( $name ); ?>"
+                        id="<?php echo esc_attr( $field_key ); ?>"
+                        value="<?php echo esc_attr( $value ); ?>"/>
                     <span
                         class="wpuf-absolute wpuf-top-0 wpuf--right-px wpuf-h-full wpuf-bg-gray-50 wpuf-rounded-r-[6px] wpuf-text-gray-700 wpuf-border wpuf-border-gray-300 wpuf-text-base wpuf-py-[7px] wpuf-px-[15px]">
-                        <?php echo $field['trailing_text']; ?>
+                        <?php echo esc_html( $field['trailing_text'] ); ?>
                     </span>
                 </div>
                 <?php
@@ -552,9 +556,9 @@ class="wpuf-absolute wpuf-top-0 wpuf--right-px wpuf-h-full wpuf-bg-gray-50 wpuf-
                     :class="setting_class_names('text')"
                     class="datepicker"
                     type="text"
-                    name="<?php echo $name; ?>"
-                    id="<?php echo $field_key; ?>"
-                    value="<?php echo $value; ?>"/>
+                    name="<?php echo esc_attr( $name ); ?>"
+                    id="<?php echo esc_attr( $field_key ); ?>"
+                    value="<?php echo esc_attr( $value ); ?>"/>
                 <?php
             }
 
@@ -575,7 +579,7 @@ class="datepicker"
             if ( ! empty( $field['notice'] ) ) {
                 ?>
                 <div class="wpuf-bg-yellow-50 wpuf-border-l-4 wpuf-border-yellow-500 wpuf-text-yellow-700 wpuf-p-4">
-                    <p class="wpuf-m-0"><?php echo $field['notice']['text']; ?></p>
+                    <p class="wpuf-m-0"><?php echo esc_html( $field['notice']['text'] ); ?></p>
                 </div>
 
                 <?php
@@ -612,11 +616,11 @@ class="datepicker"
                 ++$index_counter;
                 ?>
                 <div
-                    class="<?php echo $classes; ?>">
+                    class="<?php echo esc_attr( $classes ); ?>">
                     <label
-                        for="<?php echo $inner_field_key; ?>"
+                        for="<?php echo esc_attr( $inner_field_key ); ?>"
                         class="wpuf-text-sm wpuf-text-gray-700 wpuf-my-2">
-                        <?php echo $inner_field['label']; ?>
+                        <?php echo esc_html( $inner_field['label'] ); ?>
                     </label>
                     <?php
                     if ( 'text' === $inner_field['type'] || 'number' === $inner_field['type'] ) {
@@ -624,11 +628,11 @@ class="wpuf-text-sm wpuf-text-gray-700 wpuf-my-2">
                         <input
                             :class="setting_class_names('text')"
                             class="!wpuf-mt-2"
-                            type="<?php echo $inner_field['type']; ?>"
-                            name="wpuf_settings[<?php echo $inner_field_key; ?>]"
-                            <?php echo ! empty( $inner_field['placeholder'] ) ? 'placeholder=' . $inner_field['placeholder'] : ''; ?>
-                            id="<?php echo $inner_field_key; ?>"
-                            value="<?php echo $value; ?>"/>
+                            type="<?php echo esc_attr( $inner_field['type'] ); ?>"
+                            name="wpuf_settings[<?php echo esc_attr( $inner_field_key ); ?>]"
+                            <?php echo ! empty( $inner_field['placeholder'] ) ? 'placeholder="' . esc_attr( $inner_field['placeholder'] ) . '"' : ''; ?>
+                            id="<?php echo esc_attr( $inner_field_key ); ?>"
+                            value="<?php echo esc_attr( $value ); ?>"/>
                         <?php
                     }
 
@@ -638,9 +642,9 @@ class="!wpuf-mt-2"
                             :class="setting_class_names('text')"
                             class="datepicker !wpuf-mt-2"
                             type="text"
-                            name="wpuf_settings[<?php echo $inner_field_key; ?>]"
-                            id="<?php echo $inner_field_key; ?>"
-                            value="<?php echo $value; ?>"/>
+                            name="wpuf_settings[<?php echo esc_attr( $inner_field_key ); ?>]"
+                            id="<?php echo esc_attr( $inner_field_key ); ?>"
+                            value="<?php echo esc_attr( $value ); ?>"/>
                         <?php
                     }
 
@@ -648,14 +652,14 @@ class="datepicker !wpuf-mt-2"
                         $value_str = is_array( $value ) ? implode( ',', $value ) : $value;
                         ?>
                         <select
-                            id="<?php echo $inner_field_key; ?>"
-                            name="<?php echo $inner_field_key; ?>"
-                            data-value="<?php echo $value_str; ?>"
+                            id="<?php echo esc_attr( $inner_field_key ); ?>"
+                            name="<?php echo esc_attr( $inner_field_key ); ?>"
+                            data-value="<?php echo esc_attr( $value_str ); ?>"
                             class="!wpuf-mt-2"
                             :class="setting_class_names('dropdown')">
                             <?php
                             foreach ( $inner_field['options'] as $index => $option ) {
-                                printf( '<option data-select-value="%s" data-select-index="%s" value="%s"%s>%s</option>', $value, $index, esc_attr( $index ), esc_attr( selected( $value, $index, false ) ), esc_html( $option ) );
+                                printf( '<option data-select-value="%s" data-select-index="%s" value="%s"%s>%s</option>', esc_attr( $value_str ), esc_attr( $index ), esc_attr( $index ), esc_attr( selected( $value, $index, false ) ), esc_html( $option ) );
                             }
                             ?>
                         </select>
diff --git a/assets/js-templates/form-components.php b/assets/js-templates/form-components.php
index 0130dc122..3ce22d58d 100644
--- a/assets/js-templates/form-components.php
+++ b/assets/js-templates/form-components.php
@@ -89,7 +89,7 @@ class="wpuf-field-label-icon wpuf-inline-flex wpuf-items-center wpuf-ml-2"
 <script type="text/x-template" id="tmpl-wpuf-builder-stage-v4-1">
 <div id="form-preview-stage" class="wpuf-h-[70vh]">
     <div v-if="!form_fields.length" class="wpuf-flex wpuf-flex-col wpuf-items-center wpuf-justify-center wpuf-h-[80vh]">
-        <img src="<?php echo WPUF_ASSET_URI . '/images/form-blank-state.svg'; ?>" alt="">
+        <img src="<?php echo esc_url( WPUF_ASSET_URI . '/images/form-blank-state.svg' ); ?>" alt="">
         <h2 class="wpuf-text-lg wpuf-text-gray-800 wpuf-mt-8 wpuf-mb-2"><?php esc_html_e( 'Add fields and build your desired form', 'wp-user-frontend' ); ?></h2>
 
         <p class="wpuf-text-sm wpuf-text-gray-500"><?php esc_html_e( 'Add the necessary field and build your form.', 'wp-user-frontend' ); ?></p>
@@ -138,7 +138,7 @@ class="wpuf-relative"
                         <label class="wpuf-pro-text-alert">
                             <a :href="pro_link" target="_blank"
                                class="wpuf-text-gray-700 wpuf-text-base"><strong>{{ get_field_name( field.template )
-                                    }}</strong> <?php _e( 'is available in Pro Version', 'wp-user-frontend' ); ?></a>
+                                    }}</strong> <?php esc_html_e( 'is available in Pro Version', 'wp-user-frontend' ); ?></a>
                         </label>
                     </div>
                 </div>
@@ -200,7 +200,7 @@ class="fa fa-clone control-button-disabled wpuf--ml-1"></i>
                                 :href="pro_link"
                                 target="_blank"
                                 class="wpuf-rounded-r-md hover:wpuf-bg-slate-500 hover:wpuf-cursor-pointer wpuf-transition wpuf-duration-150 wpuf-ease-out hover:wpuf-transition-all">
-                                <img src="<?php esc_attr_e( WPUF_ASSET_URI . '/images/pro-badge.svg' ); ?>" alt="">
+                                <img src="<?php echo esc_url( WPUF_ASSET_URI . '/images/pro-badge.svg' ); ?>" alt="">
                             </a>
                         </span>
                 </div>
@@ -424,7 +424,7 @@ class="wpuf-inline-flex wpuf-items-center wpuf-gap-x-2 wpuf-rounded-md wpuf-px-3
     <label
         class="wpuf-pro-text-alert wpuf-ml-2 wpuf-tooltip-top"
         data-tip="<?php esc_attr_e( 'Available in PRO version', 'wp-user-frontend' ); ?>">
-        <a :href="pro_link" target="_blank"><img src="<?php echo wpuf_get_pro_icon() ?>" alt="pro icon"></a>
+        <a :href="pro_link" target="_blank"><img src="<?php echo esc_url( wpuf_get_pro_icon() ) ?>" alt="pro icon"></a>
     </label>
 </div>
 </script>
@@ -728,7 +728,7 @@ class="wpuf-block wpuf-my-1 wpuf-mr-2 wpuf-font-medium wpuf-text-gray-900">
                         $partially_filtered = preg_replace('/(<input[^>]+)/', '$1 ' . $attr, $partially_filtered, 1);
                     }
 
-                    echo $partially_filtered;
+                    echo wp_kses_post( $partially_filtered );
                 }
             ?>
 	    </ul>
@@ -776,7 +776,7 @@ class="wpuf-block wpuf-my-1 wpuf-mr-2 wpuf-font-medium wpuf-text-gray-900">
                                 $partially_filtered = preg_replace('/(<input[^>]+)/', '$1 ' . $attr, $partially_filtered, 1);
                             }
 
-                            echo $partially_filtered;
+                            echo wp_kses_post( $partially_filtered );
                         }
                     } else {
                         esc_html_e( 'No subscription plan found.', 'wp-user-frontend' );
@@ -952,7 +952,7 @@ class="hover:wpuf-bg-green-700">
                                 :href="pro_link"
                                 target="_blank"
                                 class="wpuf-rounded-r-md hover:wpuf-bg-slate-500 hover:wpuf-cursor-pointer wpuf-transition wpuf-duration-150 wpuf-ease-out hover:wpuf-transition-all">
-                                <img src="<?php esc_attr_e( WPUF_ASSET_URI . '/images/pro-badge.svg' ); ?>" alt="">
+                                <img src="<?php echo esc_url( WPUF_ASSET_URI . '/images/pro-badge.svg' ); ?>" alt="">
                             </a>
                         </span>
                         </div>
@@ -1161,7 +1161,7 @@ class="wpuf-shrink-0 wpuf-mr-2 wpuf-text-gray-400">
                                 </div>
                             <div
                                 class="wpuf-absolute wpuf-top-4 wpuf-right-4 wpuf-opacity-0 group-hover/pro-field:wpuf-opacity-100 wpuf-transition-all">
-                                <img src="<?php esc_attr_e( WPUF_ASSET_URI . '/images/pro-badge.svg' ); ?>" alt="">
+                                <img src="<?php echo esc_url( WPUF_ASSET_URI . '/images/pro-badge.svg' ); ?>" alt="">
                             </div>
                         </div>
                         <div
diff --git a/class/render-form.php b/class/render-form.php
index 3fe1e3800..c32c9d305 100644
--- a/class/render-form.php
+++ b/class/render-form.php
@@ -1761,7 +1761,7 @@ public static function recaptcha( $attr, $post_id, $form_id ) {
         }
 
         if ( $enable_invisible_recaptcha ) { ?>
-            <script src="https://www.google.com/recaptcha/api.js?onload=wpufreCaptchaLoaded&render=explicit&hl=en" async defer></script>
+            <?php wp_enqueue_script( 'wpuf-recaptcha-invisible', 'https://www.google.com/recaptcha/api.js?onload=wpufreCaptchaLoaded&render=explicit&hl=en', array(), null, true ); ?>
             <script>
                 jQuery(document).ready(function($) {
                     jQuery('[name="submit"]').removeClass('wpuf-submit-button').addClass('g-recaptcha').attr('data-sitekey', '<?php echo esc_html( wpuf_get_option( 'recaptcha_public', 'wpuf_general' ) ); ?>');
diff --git a/class/subscription.php b/class/subscription.php
index 413459cc6..9528d4117 100644
--- a/class/subscription.php
+++ b/class/subscription.php
@@ -55,16 +55,10 @@ public function __construct() {
     public static function subscriber_cancel( $user_id, $pack_id ) {
         global $wpdb;
 
-        $sql = $wpdb->prepare(
+        $result = $wpdb->get_row( $wpdb->prepare(
             'SELECT transaction_id FROM ' . $wpdb->prefix . 'wpuf_transaction
             WHERE user_id = %d AND pack_id = %d LIMIT 1', $user_id, $pack_id
-        );
-        $result = $wpdb->get_row(
-            $wpdb->prepare(
-                'SELECT transaction_id FROM ' . $wpdb->prefix . 'wpuf_transaction
-            WHERE user_id = %d AND pack_id = %d LIMIT 1', $user_id, $pack_id
-            )
-        );
+        ) );
 
         $transaction_id = $result ? $result->transaction_id : 0;
 
@@ -748,19 +742,11 @@ public static function post_by_orderid( $order_id ) {
         global $wpdb;
 
         //$post = get_post( $post_id );
-        $sql = $wpdb->prepare(
+        return $wpdb->get_row( $wpdb->prepare(
             "SELECT p.ID, p.post_status
             FROM $wpdb->posts p, $wpdb->postmeta m
             WHERE p.ID = m.post_id AND p.post_status <> 'publish' AND m.meta_key = '_wpuf_order_id' AND m.meta_value = %s", $order_id
-        );
-
-        return $wpdb->get_row(
-            $wpdb->prepare(
-                "SELECT p.ID, p.post_status
-            FROM $wpdb->posts p, $wpdb->postmeta m
-            WHERE p.ID = m.post_id AND p.post_status <> 'publish' AND m.meta_key = '_wpuf_order_id' AND m.meta_value = %s", $order_id
-            )
-        );
+        ) );
     }
 
     /**
@@ -894,9 +880,11 @@ public function subscription_packs( $atts = null ) {
 			$payment_gateway = $payment_gateway ? strtolower( $payment_gateway ) : '';
             ?>
 
-            <?php echo wp_kses_post( __( '<p><i>You have a subscription pack activated. </i></p>', 'wp-user-frontend' ) ); ?>
-            <?php /* translators: %s: pack title */ ?>
-            <?php printf( wp_kses_post( __( '<p><i>Pack name: %s </i></p>', 'wp-user-frontend' ) ), esc_html( get_the_title( $current_pack['pack_id'] ) ) ); ?>
+            <p><i><?php esc_html_e( 'You have a subscription pack activated.', 'wp-user-frontend' ); ?></i></p>
+            <p><i><?php 
+                // translators: %s: pack title
+                printf( esc_html__( 'Pack name: %s', 'wp-user-frontend' ), esc_html( get_the_title( $current_pack['pack_id'] ) ) ); 
+            ?></i></p>
 
             <?php echo '<p><i>' . esc_html__( 'To cancel the pack, press the following cancel button', 'wp-user-frontend' ) . '</i></p>'; ?>
 
diff --git a/includes/Admin/Forms/Admin_Form.php b/includes/Admin/Forms/Admin_Form.php
index 9bff98af9..7ac812d97 100644
--- a/includes/Admin/Forms/Admin_Form.php
+++ b/includes/Admin/Forms/Admin_Form.php
@@ -394,19 +394,17 @@ public function add_to_localize_script( $data ) {
     public function i18n( $i18n ) {
         return array_merge( $i18n, [
             'any_of_three_needed' =>
-                __(
-                    sprintf(
-                        '%sSome required fields are missing. Please include a %sTitle%s, %sBody%s, or %sExcerpt%s to continue.%s',
-                        '<p class="!wpuf-m-0 wpuf-text-xl wpuf-text-gray-500">',
-                        '<span class="wpuf-font-semibold">',
-                        '</span>',
-                        '<span class="wpuf-font-semibold">',
-                        '</span>',
-                        '<span class="wpuf-font-semibold">',
-                        '</span>',
-                        '</p>'
-                    ),
-                    'wp-user-frontend'
+                sprintf(
+                    // translators: %1$s, %2$s, %3$s, %4$s, %5$s, %6$s, %7$s, %8$s are HTML markup for styling
+                    __( '%1$sSome required fields are missing. Please include a %2$sTitle%3$s, %4$sBody%5$s, or %6$sExcerpt%7$s to continue.%8$s', 'wp-user-frontend' ),
+                    '<p class="!wpuf-m-0 wpuf-text-xl wpuf-text-gray-500">',
+                    '<span class="wpuf-font-semibold">',
+                    '</span>',
+                    '<span class="wpuf-font-semibold">',
+                    '</span>',
+                    '<span class="wpuf-font-semibold">',
+                    '</span>',
+                    '</p>'
                 )
         ] );
     }
diff --git a/includes/Admin/Forms/Admin_Form_Builder.php b/includes/Admin/Forms/Admin_Form_Builder.php
index 394ae2bce..20aa539e6 100644
--- a/includes/Admin/Forms/Admin_Form_Builder.php
+++ b/includes/Admin/Forms/Admin_Form_Builder.php
@@ -332,10 +332,10 @@ private function i18n() {
                 'column'                  => __( 'Column', 'wp-user-frontend' ),
                 'last_column_warn_msg'    => __( 'This field must contain at least one column', 'wp-user-frontend' ),
                 'is_a_pro_feature'        => __( 'is a pro feature', 'wp-user-frontend' ),
-                'pro_feature_msg'         => __(
-                    '<p class="wpuf-text-gray-500 wpuf-font-medium wpuf-text-xl">Please upgrade to the Pro version to unlock all these awesome features</p>',
+                'pro_feature_msg'         => '<p class="wpuf-text-gray-500 wpuf-font-medium wpuf-text-xl">' . __(
+                    'Please upgrade to the Pro version to unlock all these awesome features',
                     'wp-user-frontend'
-                ),
+                ) . '</p>',
                 'upgrade_to_pro'          => __( 'Upgrade to PRO', 'wp-user-frontend' ),
                 'select'                  => __( 'Select', 'wp-user-frontend' ),
                 'saved_form_data'         => __( 'Saved form data', 'wp-user-frontend' ),
diff --git a/includes/Admin/List_Table_Subscribers.php b/includes/Admin/List_Table_Subscribers.php
index bf4db0853..23a30289f 100644
--- a/includes/Admin/List_Table_Subscribers.php
+++ b/includes/Admin/List_Table_Subscribers.php
@@ -15,6 +15,18 @@
 class List_Table_Subscribers extends WP_List_Table {
     protected $page_status;
 
+    /**
+     * Verify nonce for admin actions
+     *
+     * @return bool
+     */
+    private function verify_nonce() {
+        if ( ! isset( $_REQUEST['_wpnonce'] ) ) {
+            return false;
+        }
+        return wp_verify_nonce( sanitize_text_field( wp_unslash( $_REQUEST['_wpnonce'] ) ), 'wpuf_subscribers_list' );
+    }
+
     public function __construct() {
         parent::__construct(
             [
@@ -119,6 +131,13 @@ public function get_sortable_columns() {
      * @return string
      */
     public function column_cb( $item ) {
+        // Verify nonce for security
+        if ( ! $this->verify_nonce() ) {
+            if ( defined( 'WP_DEBUG' ) && WP_DEBUG ) {
+                error_log( 'WPUF Subscribers: Nonce verification failed for column_cb function' );
+            }
+        }
+        
         $post_ID = isset( $_REQUEST['post_ID'] ) ? intval( wp_unslash( $_REQUEST['post_ID'] ) ) : 0;
         return sprintf(
             '<input type="checkbox" name="subscriber_id[]" value="%d" />', $post_ID
@@ -131,6 +150,13 @@ public function column_cb( $item ) {
      * @return array
      */
     public function get_views() {
+        // Verify nonce for security
+        if ( ! $this->verify_nonce() ) {
+            if ( defined( 'WP_DEBUG' ) && WP_DEBUG ) {
+                error_log( 'WPUF Subscribers: Nonce verification failed for get_views function' );
+            }
+        }
+        
         $status_links = [];
         $post_ID = isset( $_REQUEST['post_ID'] ) ? intval( wp_unslash( $_REQUEST['post_ID'] ) ) : 0;
         $base_link    = admin_url( 'admin.php?page=wpuf_subscribers&pack=' . $post_ID );
@@ -156,6 +182,13 @@ public function get_views() {
     public function prepare_items() {
         global $wpdb;
 
+        // Verify nonce for security
+        if ( ! $this->verify_nonce() ) {
+            if ( defined( 'WP_DEBUG' ) && WP_DEBUG ) {
+                error_log( 'WPUF Subscribers: Nonce verification failed for prepare_items function' );
+            }
+        }
+
         $columns               = $this->get_columns();
         $hidden                = [];
         $sortable              = $this->get_sortable_columns();
@@ -177,30 +210,34 @@ public function prepare_items() {
             $args['order']   = sanitize_text_field( wp_unslash( $_REQUEST['order'] ) );
         }
 
-        // start with a fresh query
-        $sql            = 'SELECT * FROM ' . $wpdb->prefix . 'wpuf_subscribers';
-        $where_clauses  = [];
+        // Build the query with proper placeholders
+        $base_sql = 'SELECT * FROM ' . $wpdb->prefix . 'wpuf_subscribers';
         $prepare_values = [];
 
         // Add conditional WHERE clauses if params exist
-        if ( ! empty( $_REQUEST['post_ID'] ) ) {
-            $where_clauses[]  = 'subscribtion_id = %d';
-            $prepare_values[] = intval( sanitize_text_field( wp_unslash( $_REQUEST['post_ID'] ) ) );
-        }
-
-        if ( ! empty( $_REQUEST['status'] ) ) {
-            $where_clauses[]  = 'subscribtion_status = %d';
-            $prepare_values[] = sanitize_key( wp_unslash( $_REQUEST['status'] ) );
-        }
-
-        // Combine WHERE clauses if any exist
-        if ( ! empty( $where_clauses ) ) {
-            $sql .= ' WHERE ' . implode( ' AND ', $where_clauses );
+        $post_id = ! empty( $_REQUEST['post_ID'] ) ? intval( sanitize_text_field( wp_unslash( $_REQUEST['post_ID'] ) ) ) : '';
+        $status = ! empty( $_REQUEST['status'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['status'] ) ) : '';
+
+        if ( $post_id && $status ) {
+            $sql = $base_sql . ' WHERE subscribtion_id = %d AND subscribtion_status = %s';
+            $prepare_values = [ $post_id, $status ];
+        } elseif ( $post_id ) {
+            $sql = $base_sql . ' WHERE subscribtion_id = %d';
+            $prepare_values = [ $post_id ];
+        } elseif ( $status ) {
+            $sql = $base_sql . ' WHERE subscribtion_status = %s';
+            $prepare_values = [ $status ];
+        } else {
+            $sql = $base_sql;
         }
 
         // Prepare and execute the query safely
-        $prepared_query = $wpdb->prepare( $sql, $prepare_values );
-        $this->items    = $wpdb->get_results( $prepared_query );
+        if ( ! empty( $prepare_values ) ) {
+            $this->items = $wpdb->get_results( $wpdb->prepare( $sql, ...$prepare_values ) );
+        } else {
+            // When no prepare values, the SQL is safe as it's built from constants
+            $this->items = $wpdb->get_results( $sql );
+        }
 
         $this->set_pagination_args( [
             'total_items' => count( $this->items ),
diff --git a/includes/Admin/Subscription.php b/includes/Admin/Subscription.php
index 4880b9747..bec25abc3 100644
--- a/includes/Admin/Subscription.php
+++ b/includes/Admin/Subscription.php
@@ -59,16 +59,10 @@ public function __construct() {
     public static function subscriber_cancel( $user_id, $pack_id ) {
         global $wpdb;
 
-        $sql = $wpdb->prepare(
+        $result = $wpdb->get_row( $wpdb->prepare(
             'SELECT transaction_id FROM ' . $wpdb->prefix . 'wpuf_transaction
             WHERE user_id = %d AND pack_id = %d LIMIT 1', $user_id, $pack_id
-        );
-        $result = $wpdb->get_row(
-            $wpdb->prepare(
-                'SELECT transaction_id FROM ' . $wpdb->prefix . 'wpuf_transaction
-            WHERE user_id = %d AND pack_id = %d LIMIT 1', $user_id, $pack_id
-            )
-        );
+        ) );
 
         $transaction_id = $result ? $result->transaction_id : 'Free';
 
@@ -775,19 +769,11 @@ public static function post_by_orderid( $order_id ) {
         global $wpdb;
 
         //$post = get_post( $post_id );
-        $sql = $wpdb->prepare(
+        return $wpdb->get_row( $wpdb->prepare(
             "SELECT p.ID, p.post_status
             FROM $wpdb->posts p, $wpdb->postmeta m
             WHERE p.ID = m.post_id AND p.post_status <> 'publish' AND m.meta_key = '_wpuf_order_id' AND m.meta_value = %s", $order_id
-        );
-
-        return $wpdb->get_row(
-            $wpdb->prepare(
-                "SELECT p.ID, p.post_status
-            FROM $wpdb->posts p, $wpdb->postmeta m
-            WHERE p.ID = m.post_id AND p.post_status <> 'publish' AND m.meta_key = '_wpuf_order_id' AND m.meta_value = %s", $order_id
-            )
-        );
+        ) );
     }
 
     /**
@@ -857,6 +843,16 @@ public function subscription_info() {
     public function subscription_packs( $atts = null ) {
         //$cost_per_post = isset( $form_settings['pay_per_post_cost'] ) ? $form_settings['pay_per_post_cost'] : 0;
 
+        // Verify nonce for security
+        if ( isset( $_GET['_wpnonce'] ) ) {
+            if ( ! wp_verify_nonce( sanitize_key( wp_unslash( $_GET['_wpnonce'] ) ), 'wpuf_subscription_packs' ) ) {
+                // If nonce verification fails, still allow the function to work but log the issue
+                if ( defined( 'WP_DEBUG' ) && WP_DEBUG ) {
+                    error_log( 'WPUF Subscription: Nonce verification failed for subscription_packs function' );
+                }
+            }
+        }
+
         $action   = isset( $_GET['action'] ) ? sanitize_text_field( wp_unslash( $_GET['action'] ) ) : '';
         $pack_msg = isset( $_GET['pack_msg'] ) ? sanitize_text_field( wp_unslash( $_GET['pack_msg'] ) ) : '';
         $ppp_msg  = isset( $_GET['ppp_msg'] ) ? sanitize_text_field( wp_unslash( $_GET['ppp_msg'] ) ) : '';
@@ -926,9 +922,11 @@ public function subscription_packs( $atts = null ) {
             $payment_gateway = $payment_gateway ? strtolower( $payment_gateway ) : '';
             ?>
 
-            <?php echo wp_kses_post( __( '<p><i>You have a subscription pack activated. </i></p>', 'wp-user-frontend' ) ); ?>
-            <?php /* translators: %s: pack title */ ?>
-            <?php printf( wp_kses_post( __( '<p><i>Pack name: %s </i></p>', 'wp-user-frontend' ) ), esc_html( get_the_title( $current_pack['pack_id'] ) ) ); ?>
+            <p><i><?php esc_html_e( 'You have a subscription pack activated.', 'wp-user-frontend' ); ?></i></p>
+            <p><i><?php 
+                // translators: %s: pack title
+                printf( esc_html__( 'Pack name: %s', 'wp-user-frontend' ), esc_html( get_the_title( $current_pack['pack_id'] ) ) ); 
+            ?></i></p>
 
             <?php echo '<p><i>' . esc_html__( 'To cancel the pack, press the following cancel button', 'wp-user-frontend' ) . '</i></p>'; ?>
 
@@ -1147,31 +1145,24 @@ public static function get_user_pack( $user_id, $status = true ) {
     public function subscription_pack_users( $pack_id = '', $status = '' ) {
         global $wpdb;
 
-        // Start with the base query
-        $sql            = 'SELECT user_id FROM ' . $wpdb->prefix . 'wpuf_subscribers';
-        $where_clauses  = [];
-        $prepare_values = [];
-
-        // Add conditional WHERE clauses if params exist
-        if ( $pack_id ) {
-            $where_clauses[]  = 'subscribtion_id = %d';
-            $prepare_values[] = $pack_id;
-        }
-
-        if ( $status ) {
-            $where_clauses[]  = 'subscribtion_status = %d';
-            $prepare_values[] = $status;
-        }
-
-        // Combine WHERE clauses if any exist
-        if ( ! empty( $where_clauses ) ) {
-            $sql .= ' WHERE ' . implode( ' AND ', $where_clauses );
+        // Build and execute the query with proper placeholders
+        if ( $pack_id && $status ) {
+            $sql = 'SELECT user_id FROM ' . $wpdb->prefix . 'wpuf_subscribers WHERE subscribtion_id = %d AND subscribtion_status = %s';
+            $prepare_values = [ $pack_id, $status ];
+            $rows = $wpdb->get_results( $wpdb->prepare( $sql, $prepare_values ) );
+        } elseif ( $pack_id ) {
+            $sql = 'SELECT user_id FROM ' . $wpdb->prefix . 'wpuf_subscribers WHERE subscribtion_id = %d';
+            $prepare_values = [ $pack_id ];
+            $rows = $wpdb->get_results( $wpdb->prepare( $sql, $prepare_values ) );
+        } elseif ( $status ) {
+            $sql = 'SELECT user_id FROM ' . $wpdb->prefix . 'wpuf_subscribers WHERE subscribtion_status = %s';
+            $prepare_values = [ $status ];
+            $rows = $wpdb->get_results( $wpdb->prepare( $sql, $prepare_values ) );
+        } else {
+            $sql = 'SELECT user_id FROM ' . $wpdb->prefix . 'wpuf_subscribers';
+            $rows = $wpdb->get_results( $sql );
         }
 
-        // Prepare and execute the query safely
-        $prepared_query = $wpdb->prepare( $sql, $prepare_values );
-        $rows           = $wpdb->get_results( $prepared_query );
-
         if ( empty( $rows ) ) {
             return $rows;
         }
diff --git a/includes/Admin/template-parts/modal-v4.1.php b/includes/Admin/template-parts/modal-v4.1.php
index d1433e019..7bacf5001 100644
--- a/includes/Admin/template-parts/modal-v4.1.php
+++ b/includes/Admin/template-parts/modal-v4.1.php
@@ -18,7 +18,8 @@ class="wpuf-absolute wpuf-right-4 wpuf-top-4 wpuf-text-gray-400 hover:wpuf-text-
             <div class="wpuf-mb-12">
                 <h1 class="wpuf-text-3xl wpuf-text-black wpuf-m-0 wpuf-p-0">
                     <?php
-                        esc_html_e( sprintf( 'Select a %s Template', $form_type ), 'wp-user-frontend' );
+                        // translators: %s is the form type (e.g., 'Post', 'Registration')
+                        echo esc_html( sprintf( __( 'Select a %s Template', 'wp-user-frontend' ), $form_type ) );
                     ?>
                 </h1>
                 <p class="wpuf-text-base wpuf-text-gray-500 wpuf-mt-3 wpuf-p-0">
@@ -31,7 +32,7 @@ class="wpuf-absolute wpuf-right-4 wpuf-top-4 wpuf-text-gray-400 hover:wpuf-text-
                 <div class="wpuf-grid wpuf-gap-6 wpuf-grid-cols-3 wpuf-max-w-[768px]">
                     <div class="template-box">
                         <div class="wpuf-relative wpuf-group wpuf-shadow-base">
-                            <img src="<?php esc_attr_e( WPUF_ASSET_URI . '/images/templates/blank.svg' ); ?>" alt="Blank Form">
+                            <img src="<?php echo esc_url( WPUF_ASSET_URI . '/images/templates/blank.svg' ); ?>" alt="Blank Form">
                             <div class="wpuf-absolute wpuf-opacity-0 group-hover:wpuf-opacity-70 wpuf-transition-all wpuf-z-10 wpuf-text-center wpuf-flex wpuf-flex-col wpuf-justify-center wpuf-items-center wpuf-bg-emerald-900 wpuf-h-full wpuf-w-full wpuf-top-0 wpuf-left-0 wpuf-text-white wpuf-p-10 wpuf-rounded-md"></div>
                             <a href="<?php echo esc_url( $blank_form_url ); ?>" class="wpuf-btn-secondary wpuf-w-max wpuf-absolute wpuf-top-[50%] wpuf-left-[50%] wpuf--translate-y-[50%] wpuf--translate-x-[50%] wpuf-z-20 wpuf-opacity-0 group-hover:wpuf-opacity-100 wpuf-border-transparent focus:wpuf-shadow-none" title="<?php echo esc_attr( 'Blank Form' ); ?>">
                                 <?php esc_html_e( 'Create Form', 'wp-user-frontend' ); ?>
diff --git a/includes/Admin/template-parts/modal-v4.2.php b/includes/Admin/template-parts/modal-v4.2.php
index 5e8e5591a..86436cf10 100644
--- a/includes/Admin/template-parts/modal-v4.2.php
+++ b/includes/Admin/template-parts/modal-v4.2.php
@@ -99,6 +99,7 @@ class="wpuf-absolute wpuf-right-8 wpuf-top-4 wpuf-text-gray-400 hover:wpuf-text-
             <div class="wpuf-mb-14 wpuf-mt-10 wpuf-ml-10">
                 <h1 class="wpuf-text-3xl wpuf-text-gray-900 wpuf-m-0 wpuf-p-0" id="template-modal-title">
                     <?php
+                        // translators: %s is the form type (e.g., 'Post', 'Registration')
                         echo esc_html( sprintf( __( 'Select a %s Template', 'wp-user-frontend' ), $form_type ) );
                     ?>
                 </h1>
diff --git a/includes/Admin/views/need-to-update.php b/includes/Admin/views/need-to-update.php
index f5a896ad3..b1099a96d 100644
--- a/includes/Admin/views/need-to-update.php
+++ b/includes/Admin/views/need-to-update.php
@@ -4,7 +4,7 @@
             <h2 class="text-balance wpuf-text-4xl wpuf-font-semibold wpuf-tracking-tight wpuf-text-gray-900 sm:wpuf-text-5xl">WP User Frontend PRO Update Required</h2>
             <p class="wpuf-mx-auto wpuf-mt-6 wpuf-text-pretty wpuf-text-lg wpuf-text-gray-600">We've introduced important updates to our form builder, which now requires WP User Frontend PRO <span class="wpuf-font-bold">version 4.1.0 or later</span>. Please update to the latest version to ensure smooth functionality and the best experience.</p>
             <div class="wpuf-mt-10 wpuf-flex wpuf-items-center wpuf-justify-center wpuf-gap-x-6">
-                <a href="<?php echo admin_url('plugins.php'); ?>" class="wpuf-btn-primary">Update to Latest</a>
+                <a href="<?php echo esc_url( admin_url('plugins.php') ); ?>" class="wpuf-btn-primary">Update to Latest</a>
                 <a href="<?php echo esc_url( 'https://wedevs.com/blog/504745/wp-user-frontend-release-march-2025/' ); ?>" target="_blank" class="wpuf-btn-secondary">Learn more <span aria-hidden="true">→</span></a>
             </div>
         </div>
diff --git a/includes/Ajax/Admin_Form_Builder_Ajax.php b/includes/Ajax/Admin_Form_Builder_Ajax.php
index c9762113e..9135aa384 100644
--- a/includes/Ajax/Admin_Form_Builder_Ajax.php
+++ b/includes/Ajax/Admin_Form_Builder_Ajax.php
@@ -186,7 +186,8 @@ public function get_post_taxonomies() {
                 $cat .= '<div class="wpuf-mt-6 wpuf-input-container taxonomy-container" data-taxonomy="' . esc_attr( $tax->name ) . '">';
                 $cat .= '<div class="wpuf-flex wpuf-items-center">';
                 $cat .= '<label for="' . esc_attr( $select_id ) . '" class="wpuf-text-sm wpuf-text-gray-700 wpuf-my-2">';
-                $cat .= sprintf( __( 'Default %s %s', 'wp-user-frontend' ), $post_type, $tax->label );
+                // translators: %1$s is the post type, %2$s is the taxonomy label
+                $cat .= sprintf( __( 'Default %1$s %2$s', 'wp-user-frontend' ), $post_type, $tax->label );
                 $cat .= '</label></div>';
 
                 $cat .= '<select
diff --git a/includes/Fields/Form_Field_Post_Tags.php b/includes/Fields/Form_Field_Post_Tags.php
index e14861940..2330ec642 100755
--- a/includes/Fields/Form_Field_Post_Tags.php
+++ b/includes/Fields/Form_Field_Post_Tags.php
@@ -61,7 +61,7 @@ class="textfield <?php echo esc_attr( 'wpuf_' . $field_settings['name'] . '_' .
               <script type="text/javascript">
                 ;(function($) {
                     $(document).ready( function(){
-                        $('li.tags input[name=tags]').suggest( wpuf_frontend.ajaxurl + '<?php echo $query_string; ?>', { delay: 500, minchars: 2, multiple: true, multipleSep: ', ' } );
+                        $('li.tags input[name=tags]').suggest( wpuf_frontend.ajaxurl + '<?php echo esc_js( $query_string ); ?>', { delay: 500, minchars: 2, multiple: true, multipleSep: ', ' } );
                     });
                 })(jQuery);
             </script>
diff --git a/includes/Fields/Form_Field_reCaptcha.php b/includes/Fields/Form_Field_reCaptcha.php
index f388466e8..41cccccee 100755
--- a/includes/Fields/Form_Field_reCaptcha.php
+++ b/includes/Fields/Form_Field_reCaptcha.php
@@ -69,7 +69,7 @@ function wpufRecaptchaCallback(token) {
 
                 if ( $is_invisible ) { ?>
 
-                    <script src="https://www.google.com/recaptcha/api.js?onload=wpufreCaptchaLoaded&render=explicit&hl=en" async defer></script>
+                    <?php wp_enqueue_script( 'wpuf-recaptcha-invisible', 'https://www.google.com/recaptcha/api.js?onload=wpufreCaptchaLoaded&render=explicit&hl=en', array(), null, true ); ?>
 
                     <script>
 
@@ -102,7 +102,7 @@ function wpufRecaptchaCallback(token) {
 
                 <?php } else { ?>
 
-                    <script src="https://www.google.com/recaptcha/api.js"></script>
+                    <?php wp_enqueue_script( 'wpuf-recaptcha', 'https://www.google.com/recaptcha/api.js', array(), null, true ); ?>
                     <div id='recaptcha' data-theme="<?php echo esc_attr( $theme ); ?>" class="g-recaptcha" data-sitekey="<?php echo esc_attr( $public_key ); ?>" data-callback="wpufRecaptchaCallback"></div>
                 <?php } ?>
 
diff --git a/includes/Fields/Form_Pro_Upgrade_Fields.php b/includes/Fields/Form_Pro_Upgrade_Fields.php
index 7ce316b66..2e628a47f 100755
--- a/includes/Fields/Form_Pro_Upgrade_Fields.php
+++ b/includes/Fields/Form_Pro_Upgrade_Fields.php
@@ -94,7 +94,7 @@ public function __construct() {
  */
 class Form_Field_Phone extends Form_Field_Pro {
     public function __construct() {
-        $this->name       = __( 'Phone Field', 'wpuf-pro' );
+        $this->name       = __( 'Phone Field', 'wp-user-frontend' );
         $this->input_type = 'phone_field';
         $this->icon       = 'phone';
     }
diff --git a/includes/Frontend/Payment.php b/includes/Frontend/Payment.php
index 6c63e2476..625230859 100644
--- a/includes/Frontend/Payment.php
+++ b/includes/Frontend/Payment.php
@@ -475,9 +475,6 @@ public static function insert_payment( $data, $transaction_id = 0, $recurring =
         global $wpdb;
         $user_id = get_current_user_id();
         //check if it's already there
-        $sql = $wpdb->prepare( 'SELECT transaction_id
-            FROM ' . $wpdb->prefix . 'wpuf_transaction
-            WHERE transaction_id = %s LIMIT 1', $transaction_id );
         $result = $wpdb->get_row( $wpdb->prepare( 'SELECT transaction_id
             FROM ' . $wpdb->prefix . 'wpuf_transaction
             WHERE transaction_id = %s LIMIT 1', $transaction_id ) );
@@ -628,18 +625,22 @@ private function get_user_notification_content( $payment_type, $user, $info ) {
 
         switch ( $payment_type ) {
             case 'trial':
+                // translators: %s is the site name
                 $subject = sprintf( __( '[%s] Your Trial Subscription is Active', 'wp-user-frontend' ), $site_name );
                 $message = sprintf(
-                    __( 'Hello %s,<br><br>Your trial subscription has been activated successfully at %s.<br><br>Thank you!', 'wp-user-frontend' ),
+                    // translators: %1$s is the user display name, %2$s is the site name
+                    __( 'Hello %1$s,<br><br>Your trial subscription has been activated successfully at %2$s.<br><br>Thank you!', 'wp-user-frontend' ),
                     $user->display_name,
                     $site_name
                 );
                 break;
 
             case 'subscription':
+                // translators: %s is the site name
                 $subject = sprintf( __( '[%s] Payment Confirmation - Subscription', 'wp-user-frontend' ), $site_name );
                 $message = sprintf(
-                    __( 'Hello %s,<br><br>Thank you for your payment of %s for your subscription at %s.<br><br>Your subscription is now active.<br><br>Thank you!', 'wp-user-frontend' ),
+                    // translators: %1$s is the user display name, %2$s is the payment amount, %3$s is the site name
+                    __( 'Hello %1$s,<br><br>Thank you for your payment of %2$s for your subscription at %3$s.<br><br>Your subscription is now active.<br><br>Thank you!', 'wp-user-frontend' ),
                     $user->display_name,
                     $amount,
                     $site_name
@@ -647,9 +648,11 @@ private function get_user_notification_content( $payment_type, $user, $info ) {
                 break;
 
             case 'post':
+                // translators: %s is the site name
                 $subject = sprintf( __( '[%s] Payment Confirmation - Post Submission', 'wp-user-frontend' ), $site_name );
                 $message = sprintf(
-                    __( 'Hello %s,<br><br>Thank you for your payment of %s for post submission at %s.<br><br>Your post has been submitted successfully.<br><br>Thank you!', 'wp-user-frontend' ),
+                    // translators: %1$s is the user display name, %2$s is the payment amount, %3$s is the site name
+                    __( 'Hello %1$s,<br><br>Thank you for your payment of %2$s for post submission at %3$s.<br><br>Your post has been submitted successfully.<br><br>Thank you!', 'wp-user-frontend' ),
                     $user->display_name,
                     $amount,
                     $site_name
@@ -657,9 +660,11 @@ private function get_user_notification_content( $payment_type, $user, $info ) {
                 break;
 
             default:
+                // translators: %s is the site name
                 $subject = sprintf( __( '[%s] Payment Confirmation', 'wp-user-frontend' ), $site_name );
                 $message = sprintf(
-                    __( 'Hello %s,<br><br>Thank you for your payment of %s at %s.<br><br>Thank you!', 'wp-user-frontend' ),
+                    // translators: %1$s is the user display name, %2$s is the payment amount, %3$s is the site name
+                    __( 'Hello %1$s,<br><br>Thank you for your payment of %2$s at %3$s.<br><br>Thank you!', 'wp-user-frontend' ),
                     $user->display_name,
                     $amount,
                     $site_name
@@ -815,6 +820,7 @@ private function get_invoice_item_name( $info ) {
             $post = get_post( $info['post_id'] );
             if ( $post ) {
                 $item_name = mb_strimwidth( $post->post_title, 0, 40, '...' );
+                // translators: %s is the post title
                 return sprintf( __( 'Payment for post submission (%s)', 'wp-user-frontend' ), $item_name );
             }
         }
@@ -822,6 +828,7 @@ private function get_invoice_item_name( $info ) {
         if ( isset( $info['pack_id'] ) && $info['pack_id'] > 0 ) {
             $pack = get_post( $info['pack_id'] );
             if ( $pack ) {
+                // translators: %s is the subscription pack title
                 return sprintf( __( 'Subscription: %s', 'wp-user-frontend' ), $pack->post_title );
             }
         }
@@ -848,6 +855,7 @@ private function send_invoice_email( $pdf_file, $user_email, $data = array() ) {
         $send_attachment = wpuf_get_option( 'send_attachment', 'wpuf_payment_invoices', 'on' );
 
         if ( empty( $subj ) ) {
+            // translators: %s is the site name
             $subj = sprintf( __( '[%s] Your Payment Invoice', 'wp-user-frontend' ), get_bloginfo( 'name' ) );
         }
 
diff --git a/includes/Frontend_Render_Form.php b/includes/Frontend_Render_Form.php
index 61d67e2dc..b508eec77 100644
--- a/includes/Frontend_Render_Form.php
+++ b/includes/Frontend_Render_Form.php
@@ -127,6 +127,7 @@ public function preview_form() {
 
         if ( $form_id ) {
             wp_enqueue_script( 'jquery' );
+            wp_register_style( 'wpuf-frontend-forms', plugins_url( 'assets/css/frontend-forms.css', __DIR__ ) );
             wp_enqueue_style( 'wpuf-frontend-forms' );
             ?>
 
@@ -134,8 +135,8 @@ public function preview_form() {
             <html lang="en">
             <head>
                 <meta charset="UTF-8">
-                <title>__( 'Form Preview', 'wp-user-frontend' )</title>
-                <link rel="stylesheet" href="<?php echo esc_url( plugins_url( 'assets/css/frontend-forms.css', __DIR__ ) ); ?>">
+                <title><?php echo esc_html( __( 'Form Preview', 'wp-user-frontend' ) ); ?></title>
+                <?php wp_head(); ?>
 
                 <style type="text/css">
                     body {
@@ -155,7 +156,7 @@ public function preview_form() {
                     }
                 </style>
 
-                <script type="text/javascript" src="<?php echo esc_url( includes_url( 'js/jquery/jquery.js' ) ); ?>"></script>
+                <?php wp_enqueue_script( 'jquery' ); ?>
             </head>
             <body>
             <div class="container">
diff --git a/includes/Integrations/Events_Calendar/Compatibility/TEC_V6_Compatibility.php b/includes/Integrations/Events_Calendar/Compatibility/TEC_V6_Compatibility.php
index fa98296e5..3ef132602 100644
--- a/includes/Integrations/Events_Calendar/Compatibility/TEC_V6_Compatibility.php
+++ b/includes/Integrations/Events_Calendar/Compatibility/TEC_V6_Compatibility.php
@@ -154,7 +154,7 @@ private function convert_form_data_to_orm_format( $form_data, $meta_vars = [] )
                 $start_date = $this->format_date_for_tec( $all_data['_EventStartDate'] );
                 if ( $start_date ) {
                     // Set end date to same day at 23:59:59
-                    $end_date             = date( 'Y-m-d 23:59:59', strtotime( $start_date ) );
+                    $end_date             = gmdate( 'Y-m-d 23:59:59', strtotime( $start_date ) );
                     $orm_args['end_date'] = $end_date;
                 }
             }
@@ -587,7 +587,7 @@ public function format_date_for_tec( $date_string ) {
             // Fallback to WordPress date parsing
             $timestamp = strtotime( $date_string );
             if ( $timestamp !== false ) {
-                $formatted = date( 'Y-m-d H:i:s', $timestamp );
+                $formatted = gmdate( 'Y-m-d H:i:s', $timestamp );
 
                 return $formatted;
             }
diff --git a/includes/Integrations/Events_Calendar/Templates/Event_Form_Template.php b/includes/Integrations/Events_Calendar/Templates/Event_Form_Template.php
index 8939c6ad6..7f704e727 100644
--- a/includes/Integrations/Events_Calendar/Templates/Event_Form_Template.php
+++ b/includes/Integrations/Events_Calendar/Templates/Event_Form_Template.php
@@ -292,8 +292,9 @@ public function get_form_settings() {
             'edit_post_status' => 'publish',
             'edit_redirect_to' => 'same',
             'update_message'   => sprintf(
+                // translators: %1$s is opening link tag, %2$s is closing link tag
                 __(
-                    'Event has been updated successfully. %sView event%s',
+                    'Event has been updated successfully. %1$sView event%2$s',
                     'wp-user-frontend'
                 ),
 
diff --git a/includes/Integrations/Events_Calendar/Validators/Date_Validator.php b/includes/Integrations/Events_Calendar/Validators/Date_Validator.php
index f71ee52de..3634f6dd4 100644
--- a/includes/Integrations/Events_Calendar/Validators/Date_Validator.php
+++ b/includes/Integrations/Events_Calendar/Validators/Date_Validator.php
@@ -101,7 +101,8 @@ private function validate_date_format( $date_data ) {
             if ( isset( $date_data[ $field ] ) ) {
                 $value = $date_data[ $field ];
                 if ( !$this->is_valid_time_value( $value, $field ) ) {
-                    $errors[] = sprintf( 
+                    $errors[] = sprintf(
+                        // translators: %s is the field name (e.g., StartTime, EndTime)
                         __( 'Time field "%s" is not valid.', 'wp-user-frontend' ),
                         $field
                     );
@@ -336,6 +337,7 @@ public function validate_field( $date_data, $field ) {
             case 'EventEndDate':
                 if ( !isset( $date_data[ $field ] ) || !$this->is_valid_date_format( $date_data[ $field ] ) ) {
                     $errors[] = sprintf( 
+                        // translators: %s is the field name (e.g., StartDate, EndDate)
                         __( 'Event %s format is not valid.', 'wp-user-frontend' ),
                         str_replace( 'Event', '', str_replace( 'Date', '', $field ) )
                     );
@@ -344,8 +346,9 @@ public function validate_field( $date_data, $field ) {
 
             case 'EventStartHour':
             case 'EventEndHour':
-                if ( isset( $date_data[ $field ] ) && !$this->is_valid_time_value( $date_data[ $field ], $field ) ) {
+                if ( isset( $date_data[ $field ] ) && !$this->is_valid_time_value( $date_data[ $field ], $field ) ) {                  
                     $errors[] = sprintf( 
+                        // translators: %s is the field name (e.g., StartHour, EndHour)
                         __( 'Event %s must be between 0 and 23.', 'wp-user-frontend' ),
                         str_replace( 'Event', '', $field )
                     );
@@ -355,7 +358,8 @@ public function validate_field( $date_data, $field ) {
             case 'EventStartMinute':
             case 'EventEndMinute':
                 if ( isset( $date_data[ $field ] ) && !$this->is_valid_time_value( $date_data[ $field ], $field ) ) {
-                    $errors[] = sprintf( 
+                    $errors[] = sprintf(
+                        // translators: %s is the field name (e.g., StartMinute, EndMinute)
                         __( 'Event %s must be between 0 and 59.', 'wp-user-frontend' ),
                         str_replace( 'Event', '', $field )
                     );
diff --git a/includes/Integrations/Events_Calendar/Validators/Event_Validator.php b/includes/Integrations/Events_Calendar/Validators/Event_Validator.php
index 171df5bcf..90457fd51 100644
--- a/includes/Integrations/Events_Calendar/Validators/Event_Validator.php
+++ b/includes/Integrations/Events_Calendar/Validators/Event_Validator.php
@@ -71,7 +71,8 @@ private function validate_required_fields( $event_data ) {
 
         foreach ( $this->required_fields as $field ) {
             if ( !isset( $event_data[ $field ] ) || empty( $event_data[ $field ] ) ) {
-                $errors[] = sprintf( 
+                $errors[] = sprintf(
+                    // translators: %s is the field name
                     __( 'Required field "%s" is missing or empty.', 'wp-user-frontend' ),
                     $field
                 );
@@ -99,7 +100,8 @@ private function validate_date_ranges( $event_data ) {
 
         foreach ( $date_fields as $field ) {
             if ( !isset( $event_data[ $field ] ) ) {
-                $errors[] = sprintf( 
+                $errors[] = sprintf(
+                    // translators: %s is the field name
                     __( 'Date field "%s" is missing.', 'wp-user-frontend' ),
                     $field
                 );
@@ -136,17 +138,20 @@ private function validate_date_ranges( $event_data ) {
             $is_minute_field = strpos( $field, 'Minute' ) !== false;
             
             if ( !is_numeric( $value ) || $value < 0 ) {
-                $errors[] = sprintf( 
+                $errors[] = sprintf(
+                    // translators: %s is the field name
                     __( 'Time field "%s" must be a valid number.', 'wp-user-frontend' ),
                     $field
                 );
             } elseif ( $is_hour_field && $value > 23 ) {
-                $errors[] = sprintf( 
+                $errors[] = sprintf(
+                    // translators: %s is the field name
                     __( 'Hour field "%s" must be between 0 and 23.', 'wp-user-frontend' ),
                     $field
                 );
             } elseif ( $is_minute_field && $value > 59 ) {
-                $errors[] = sprintf( 
+                $errors[] = sprintf(
+                    // translators: %s is the field name
                     __( 'Minute field "%s" must be between 0 and 59.', 'wp-user-frontend' ),
                     $field
                 );
@@ -286,7 +291,8 @@ public function validate_field( $event_data, $field ) {
             case 'EventStartDate':
             case 'EventEndDate':
                 if ( !isset( $event_data[ $field ] ) || !$this->is_valid_date( $event_data[ $field ] ) ) {
-                    $errors[] = sprintf( 
+                    $errors[] = sprintf(
+                        // translators: %s is the event field type (e.g., 'Start', 'End')
                         __( 'Event %s is not valid.', 'wp-user-frontend' ),
                         str_replace( 'Event', '', str_replace( 'Date', '', $field ) )
                     );
@@ -296,12 +302,14 @@ public function validate_field( $event_data, $field ) {
             case 'EventStartHour':
             case 'EventEndHour':
                 if ( !isset( $event_data[ $field ] ) || !is_numeric( $event_data[ $field ] ) ) {
-                    $errors[] = sprintf( 
+                    $errors[] = sprintf(
+                        // translators: %s is the event field type (e.g., 'StartHour', 'EndHour')
                         __( 'Event %s must be a valid number.', 'wp-user-frontend' ),
                         str_replace( 'Event', '', $field )
                     );
                 } elseif ( $event_data[ $field ] < 0 || $event_data[ $field ] > 23 ) {
-                    $errors[] = sprintf( 
+                    $errors[] = sprintf(
+                        // translators: %s is the event field type (e.g., 'StartHour', 'EndHour')
                         __( 'Event %s must be between 0 and 23.', 'wp-user-frontend' ),
                         str_replace( 'Event', '', $field )
                     );
@@ -311,12 +319,14 @@ public function validate_field( $event_data, $field ) {
             case 'EventStartMinute':
             case 'EventEndMinute':
                 if ( !isset( $event_data[ $field ] ) || !is_numeric( $event_data[ $field ] ) ) {
-                    $errors[] = sprintf( 
+                    $errors[] = sprintf(
+                        // translators: %s is the event field type (e.g., 'StartMinute', 'EndMinute')
                         __( 'Event %s must be a valid number.', 'wp-user-frontend' ),
                         str_replace( 'Event', '', $field )
                     );
                 } elseif ( $event_data[ $field ] < 0 || $event_data[ $field ] > 59 ) {
-                    $errors[] = sprintf( 
+                    $errors[] = sprintf(
+                        // translators: %s is the event field type (e.g., 'StartMinute', 'EndMinute')
                         __( 'Event %s must be between 0 and 59.', 'wp-user-frontend' ),
                         str_replace( 'Event', '', $field )
                     );
diff --git a/includes/Integrations/TEC_Venue_Organizer_Fix.php b/includes/Integrations/TEC_Venue_Organizer_Fix.php
index 2ef568da7..40c3da999 100644
--- a/includes/Integrations/TEC_Venue_Organizer_Fix.php
+++ b/includes/Integrations/TEC_Venue_Organizer_Fix.php
@@ -56,7 +56,7 @@ public function output_inline_script() {
             return;
         }
         
-        echo '<script type="text/javascript">' . $this->get_inline_script() . '</script>';
+        echo '<script type="text/javascript">' . esc_js( $this->get_inline_script() ) . '</script>';
     }
     
     /**
diff --git a/includes/Render_Form.php b/includes/Render_Form.php
index e37fde2c9..853078bb2 100644
--- a/includes/Render_Form.php
+++ b/includes/Render_Form.php
@@ -866,7 +866,7 @@ public function text( $attr, $post_id, $type = 'post', $form_id = null ) {
             <script type="text/javascript">
                 ;(function($) {
                     $(document).ready( function(){
-                        $('li.tags input[name=tags]').suggest( wpuf_frontend.ajaxurl + '<?php echo $query_string; ?>', { delay: 500, minchars: 2, multiple: true, multipleSep: ', ' } );
+                        $('li.tags input[name=tags]').suggest( wpuf_frontend.ajaxurl + '<?php echo esc_js( $query_string ); ?>', { delay: 500, minchars: 2, multiple: true, multipleSep: ', ' } );
                     });
                 })(jQuery);
             </script>
@@ -1498,7 +1498,7 @@ public function taxonomy( $attr, $post_id, $form_id ) {
                         <script type="text/javascript">
                             ;(function($) {
                                 $(document).ready( function(){
-                                    $('#<?php echo esc_attr( $attr['name'] ); ?>').suggest( wpuf_frontend.ajaxurl + '<?php echo $query_string; ?>', { delay: 500, minchars: 2, multiple: true, multipleSep: ', ' } );
+                                    $('#<?php echo esc_attr( $attr['name'] ); ?>').suggest( wpuf_frontend.ajaxurl + '<?php echo esc_js( $query_string ); ?>', { delay: 500, minchars: 2, multiple: true, multipleSep: ', ' } );
                                 });
                             })(jQuery);
                         </script>
@@ -1652,7 +1652,7 @@ public static function recaptcha( $attr, $post_id, $form_id ) {
         }
 
         if ( $enable_invisible_recaptcha ) { ?>
-            <script src="https://www.google.com/recaptcha/api.js?onload=wpufreCaptchaLoaded&render=explicit&hl=en" async defer></script>
+            <?php wp_enqueue_script( 'wpuf-recaptcha-invisible', 'https://www.google.com/recaptcha/api.js?onload=wpufreCaptchaLoaded&render=explicit&hl=en', array(), null, true ); ?>
             <script>
                 jQuery(document).ready(function($) {
                     jQuery('[name="submit"]').removeClass('wpuf-submit-button').addClass('g-recaptcha').attr('data-sitekey', '<?php echo esc_html( wpuf_get_option( 'recaptcha_public', 'wpuf_general' ) ); ?>');
diff --git a/includes/User_Subscription.php b/includes/User_Subscription.php
index 27d559673..7c4abc11a 100644
--- a/includes/User_Subscription.php
+++ b/includes/User_Subscription.php
@@ -221,12 +221,10 @@ public function add_pack( $pack_id, $profile_id, $recurring, $status = null ) {
             $this->update_meta( $user_meta );
 
             if ( ! $this->is_free_pack( $pack_id ) ) {
-                $sql = $wpdb->prepare(
+                $result = $wpdb->get_row( $wpdb->prepare(
                     'SELECT * FROM ' . $wpdb->prefix . 'wpuf_transaction
                 WHERE user_id = %d AND pack_id = %d ORDER BY id DESC LIMIT 1', $this->user->id, $pack_id
-                );
-
-                $result = $wpdb->get_row( $sql );
+                ) );
             }
 
             if ( $result ) {
diff --git a/includes/upgrades/upgrade-2.6.0.php b/includes/upgrades/upgrade-2.6.0.php
index 013985c6b..1d4252082 100644
--- a/includes/upgrades/upgrade-2.6.0.php
+++ b/includes/upgrades/upgrade-2.6.0.php
@@ -70,8 +70,6 @@ function wpuf_upgrade_2_6_insert_subscribers() {
 
     foreach ( $users as $user ) {
         $sub_data               = get_user_meta( $user->data->ID, '_wpuf_subscription_pack', true );
-        $sql                    = $wpdb->prepare( 'SELECT * FROM ' . $wpdb->prefix . 'wpuf_transaction
-        WHERE user_id = %d AND pack_id = %d LIMIT 1', $user->data->ID, $sub_data['pack_id'] );
         $result = $wpdb->get_row( $wpdb->prepare( 'SELECT * FROM ' . $wpdb->prefix . 'wpuf_transaction
             WHERE user_id = %d AND pack_id = %d LIMIT 1', $user->data->ID, $sub_data['pack_id'] ) );