Input validation vulnerability in WP-FormAssembly 2.0.10

The WP-FormAssembly plugin for WordPress has a security issue called Stored Cross-Site Scripting that affects all versions up to and including 2.0.10. This is because the plugin doesn’t properly clean up user-entered information and doesn’t protect against malicious code. As a result, attackers who are logged in with contributor-level access or higher can add harmful code to pages, which will run whenever someone views the page.