Input validation vulnerability in WP-EMail 2.67.2

The WP-EMail plugin for WordPress is vulnerable to Cross-Site Scripting in versions up to and including 2.67.2. Cross-Site Scripting is when attackers inject malicious code into a website, which can then be executed by the browser of an unsuspecting user. This vulnerability could allow unauthenticated attackers to inject arbitrary web scripts into a website, compromising the security of the website and any users who visit it. The vulnerability is due to the plugin not properly sanitizing user input and not properly escaping output.