Input validation vulnerability in WP-ContactForm 1.5

The WP-ContactForm plugin for WordPress versions up to and including 1.5 alpha has a vulnerability that could allow someone with administrative access to inject harmful web scripts into pages that any user would be able to view. This is caused by a lack of proper sanitization and output escaping of certain parameters and IFRAME elements. This could give the attacker the ability to access a user’s information or perform other malicious activities.