Input validation vulnerability in Contact Form Builder by vcita 2.6.4

The vCita Contact Form and Calls To Action plugin for WordPress is vulnerable to a type of cyber attack called Cross-Site Request Forgery in versions up to 2.6.4. This is because the vcita-callback.php file does not validate the nonce, which is a security feature. This means that unauthenticated attackers can make changes to the plugin’s settings and inject malicious JavaScript into the website if they can get a website administrator to click on a link.