Input validation vulnerability in Email Template Designer – WP HTML Mail 2.9.1

The WP HTML Mail plugin for WordPress is vulnerable to HTML injection. This means that unauthenticated attackers can inject arbitrary HTML into pages that would be executed. In order to do this, they must first trick an administrator into performing an action, such as clicking on a link. This vulnerability affects versions up to and including 2.9.0.3, because input sanitization is not enough.