Input validation vulnerability in Booking Calendar Contact Form 1.2.40

The Booking Calendar Contact Form plugin for WordPress is vulnerable to a type of attack called Reflected Cross-Site Scripting. This attack could allow an unauthenticated attacker to inject malicious code into a website page. When a user visits this page, the code will be executed and can do things like steal information or take control of the user’s computer. This vulnerability affects versions of the plugin up to and including version 1.2.40 and is due to the plugin not properly sanitizing and escaping user input.