Input validation vulnerability in Contact Form 2.0.10

The Contact Form plugin for WordPress is vulnerable to a security issue called Cross-Site Request Forgery. This means that versions up to and including 2.0.10 could be used by unauthenticated attackers to change the contact form’s styling by tricking a site administrator into clicking on a malicious link. This is due to the missing or incorrect validation of a security feature called a nonce on the wpcf_styling_page() function.