Input validation vulnerability in Contact Form Email 1.3.43

The Contact Form Email plugin for WordPress is vulnerable to a type of attack called Stored Cross-Site Scripting. This attack is possible when administrator-level permission users change settings in all versions of the plugin up to and including 1.3.43. This type of attack can be used to inject malicious web scripts into pages on the website. These scripts can be triggered to run whenever a user accesses the injected page. This vulnerability only affects WordPress multi-site installations and installations where a security feature called unfiltered_html has been disabled.