Contact Form Entries < 1.3.1 - Contributor+ Stored XSS

The plugin does not sanitize and escape the vx-entries shortcode attributes before using them, which could allow a logged in user with roles as low as contributor to inject arbitrary web scripts into posts or pages.