Input validation vulnerability in Flo Forms – Easy Drag & Drop Form Builder 1.0.40

The Flo Forms plugin for WordPress is vulnerable to an attack called Stored Cross-Site Scripting. This means that if someone with administrator-level access to the website uses the plugin in versions up to and including 1.0.40, they can put malicious code on the website. This code will then run whenever a user looks at the page with the code on it. This attack only works on WordPress websites that have multiple sites, or if the website has disabled a security feature called unfiltered_html.