weForms < 1.6.14 - Admin+ Stored Cross-Site Scripting

On the dashboard navigate to weForms > All Forms > Add Form > Choose Contact Form;
Click Create Form >  Settings
Inject with cross-site scripting (xss) payload: <img src=x onerror=alert(document.cookie);> on Message to Show form.
Save Form
On the post/page containing the form, fill up the contact form and submit it to trigger the payload