Input validation vulnerability in WP-FormAssembly 2.0.7

The WP-FormAssembly plugin for WordPress is vulnerable to a type of attack called Stored Cross-Site Scripting. In versions up to and including 2.0.7, the plugin does not properly check user supplied information or protect against malicious scripts. This leaves the door open for attackers with contributor-level or higher permissions to inject malicious scripts into pages that will execute when any user visits that page.