Input validation vulnerability in WP Mailto Links – Protect Email Addresses 3.1.3

The WP Mailto Links – Protect Email Addresses plugin for WordPress is vulnerable to a type of cyber attack known as Stored Cross-Site Scripting. In versions up to, and including, 3.1.3, this attack was possible because the plugin did not properly filter and check information that users input into certain parts of the plugin. This allowed attackers with certain permissions to insert malicious web scripts into pages which would then be run whenever someone accessed the page. A partial fix was released with version 3.1.3 and a full fix was released with version 3.1.4.