Input validation vulnerability in Contact Form and Calls To Action by vcita 2.6.4

The [vcita] plugin for WordPress websites is vulnerable to an attack called Stored Cross-Site Scripting. This type of attack can allow someone with a certain level of access to the website, such as a contributor or higher, to inject malicious code into web pages. This code will execute anytime a user visits the affected page. Versions of the [vcita] plugin up to and including 2.6.4 are vulnerable due to a lack of input validation and output escaping.