Input validation vulnerability in Contact Form Manager 1.6

The Contact Form Manager plugin for WordPress has a security issue where a type of hacking called Stored Cross-Site Scripting can occur. This happens when the plugin’s [xyz-cfm-form] feature is used and can affect all versions of the plugin, including the latest one, 1.6.1. This is because the plugin does not properly clean and secure information provided by users. This means that people with contributor or higher access can put harmful code into pages that will run whenever someone visits those pages.