WordPress Fruitful 3.8 Cross Site Scripting about naxsi HOT 1 CLOSED

Given the fact that you have a very stupid XSS, there are multiple ways to break this and sort of block it, but normally the right route is to update the plugin.
that said what you probably want to do is to create a rule for the comment value in a POST request to forbid any < and > (note that you also need to block any UTF-8 chars that resembles to those symbols because some browsers does the normalization of the html code and would interpret guillemets as < and >)

An example what the rule could look like is this:

MainRule "str:>" "msg:Fruitful XSS" "mz:$BODY_VAR:comment" "s:$UWA:8" id:1111111;
MainRule "str:<" "msg:Fruitful XSS" "mz:$BODY_VAR:comment" "s:$UWA:8" id:1111112;

from naxsi.