Unvalidated input and lack of output encoding in the Constant Contact Forms WordPress plugin versions before 1.8.8 lead to multiple Stored Cross-Site Scripting vulnerabilities which allowed high-privileged user (Editor+) to inject arbitrary JavaScript code or HTML in posts where the malicious form is embed.