Input validation vulnerability in Elastic Email Sender 1.2.6

The Elastic Email Sender plugin for WordPress has a security issue that could allow someone to add malicious code to webpages. To be affected, you must have a multi-site WordPress installation or have disabled a security feature called unfiltered_html. The issue affects versions up to and including 1.2.6. A person with administrator-level access or higher would be able to inject arbitrary web scripts into pages. This means that anyone who visits the page with the malicious code could be affected.