Input validation vulnerability in WP Forms Puzzle Captcha 4.1

The WP Forms Puzzle Captcha plugin for WordPress is vulnerable to security threats in versions up to and including 4.1. An unauthenticated attacker could send a forged request to a site administrator, potentially getting them to click on a link, as there is no validation of the nonce (security token) for one of the functions. Additionally, user input is not filtered enough, resulting in stored Cross-Site Scripting.