Form - Contact Form <= 1.2.4 - Admin+ Stored Cross-Site Scripting

The plugin does not sanitize and escape Custom text fields, which could allow high-privileged users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed

PoC

Create/edit a form, add a Custom Text field, put the following payload in it: , save the field and update the form The XSS will be triggered in page/post where the form is embed