Contact Form Email < 1.3.38 - Unauthenticated Stored Cross-Site Scripting

1. Publish the default form to a page by clicking on "Contact Form to Email" in the sidebar, and the "Publish" button beside the form name.
2. Visit the form on the frontend. Fill in the Email and Subject with arbitrary, valid values. Fill in the Message field with `</textarea><img src=x onerror=alert(/XSS/)>`
3. Submit the form.
4. In the backend, on the "Contact Form to Email" page, click on "Messages" and click the "Edit" button corresponding to the new message.
5. See the XSS has been triggered.