Ruphail

**Name of the Vulnerable Software and Affected Versions** Contact Form Manager plugin for WordPress versions up to, and including, 1.6.1 **Description** The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the plugin's [xyz-cfm-form] shortcode, allowing authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages. These scripts will execute whenever a user accesses an injected page. **Recommendations** For versions up to, and including, 1.6.1, update to a version that addresses the insufficient input sanitization and output escaping issue. As a temporary workaround, consider restricting access to the [xyz-cfm-form] shortcode for users with contributor-level and above permissions to minimize the risk of exploitation.