Input validation vulnerability in Simple Contact Form Plugin for WordPress – WP Easy Contact 4.0.0

The WP Easy Contact plugin for WordPress, which allows users to create simple contact forms, has a security issue. This vulnerability, known as Stored Cross-Site Scripting, affects all versions up to 4.0.0. This is due to inadequate measures taken to protect against malicious code being inserted into the plugin’s ’emd_mb_meta’ shortcode. As a result, attackers with contributor-level access or higher can insert harmful scripts onto pages, which will then run whenever a user visits that page.