Contact Form Email < 1.3.38 - Unauthenticated Stored Cross-Site Scripting

The plugin does not escape submitted values before displaying them in the HTML, leading to a Stored XSS vulnerability.

PoC

1. Publish the default form to a page by clicking on “Contact Form to Email” in the sidebar, and the “Publish” button beside the form name. 2. Visit the form on the frontend. Fill in the Email and Subject with arbitrary, valid values. Fill in the Message field with ![](x) 3. Submit the form. 4. In the backend, on the “Contact Form to Email” page, click on “Messages” and click the “Edit” button corresponding to the new message. 5. See the XSS has been triggered.