Add-on SweetAlert Contact Form 7 < 1.0.8 - Authenticated Stored Cross-Site Scripting (XSS)

Description

Stored XSS "post-auth" in "tittle" field of the "Error Alert" and "Success Alert" sections of the plugin's settings page due to poor sanitization of entered characters.

When you enter the payload and save the changes, it is permanently embedded in the html code of the settings page, so all users who visit the plugin's settings can suffer the attack.

Edit (WPScanTeam):
May 13th, 2020 - Confirmed & Escalated to WP Plugin Team
May 21st, 2020 - v1.0.8 released, fixing the issu