WPForms < 2.0.0.2 - Contributor+ Stored Cross-Site Scripting via OptinMonster Integration

Description

The plugin does not sanitise and escape some of its data attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks. Exploitation additionally requires the OptinMonster plugin to be installed and configured with an active inline campaign on the affected page.