WordPress Contact Form Plugin <= 7.3 - Remote File Inclusion

Because of this vulnerability in cforms-css.php, the attackers can execute arbitrary PHP code via a URL in the "tm" parameter. Solution Update the plugin...