Best Payments Plugin for WP < 4.2.1 - Unauthenticated Stored Cross-Site Scripting

The plugin does not sanitise and escape user input given in its forms, which could allow unauthenticated attackers to perform Cross-Site Scripting attacks against admins

PoC

As unauthenticated, on a page/post where there is a contact form created via the plugin, put the following payload in the Name, Subject and Message fields: The XSS will be triggered when an admin will view the related entry