Input validation vulnerability in Contact Form Builder by vcita 4.9.1

The Contact Form Builder plugin for WordPress created by vcita is vulnerable to a security risk called Stored Cross-Site Scripting in versions up to 4.9.1. This security risk occurs because the plugin does not properly filter the input or prevent malicious scripts from being loaded in pages. As a result, an attacker with the ability to edit posts, such as a Contributor or higher user, can inject arbitrary web scripts into pages that will be executed when someone visits the injected page.