UR-4225 Fix - Triage snyk vulnerability report findings

[MILAN88888]

All Submissions:

• Have you followed the User Registration Contributing guideline?
• Does your code follow the WordPress' coding standards?
• Have you checked to ensure there aren't other open Pull Requests for the same update/change?

Changes proposed in this Pull Request:

This PR fixes several security issues, including nonce handling, escaping, and sanitization improvements. Some medium-severity issues remain, but they can be safely ignored because they occur in the frontend JavaScript and the data involved is already sanitized on the backend.
For future JavaScript implementations, we should follow a detached DOM structure when appending HTML to ensure safer and more maintainable code.
`// ❌ BAD — appends to live DOM 100 times = 100 repaints $(plans).each(function(k, item) { urmg_container.append('

' + item.title + '

'); // browser redraws each time });

// ✅ GOOD — build everything in memory first, ONE append = ONE repaint var $wrapper = $('

'); // detached, in memory $(plans).each(function(k, item) { $wrapper.append($card); // no repaint, just memory operation }); urmg_container.append($wrapper); // ONE repaint at the end ✅`
[
snyk-report.html
](url)

How to test the changes in this Pull Request:

1. Changes are done in many area so we have test all the functionalities.( login, settings, users, membership, email, email preview, form builder, admin notices, plugin updaters... etc)
2. To get the report we have setup the snyk ai secutiry in local system
3. npm install -g snyk
4. synk auth
5. synk monitor
6. login and enable

Types of changes:

• Bug fix (non-breaking change which fixes an issue)
• Enhancement (modification of the currently available functionality)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)

Other information:

• Have you added an explanation of what your changes do and why you'd like us to include them?
• Have you successfully ran tests with your changes locally?
• Have you updated the documentation accordingly?

Changelog entry

UR-4225 Fix - Triage snyk vulnerability report findings.