Contact Form Generator : Creative form builder for WordPress <= 2.1.86 - Cross-Site Request Forgery

The Contact Form Generator : Creative form builder for WordPress for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.1.86. This is due to missing or incorrect nonce validation on cfg_forms page. This makes it possible for unauthenticated attackers to modify and create contact form fields, create and delete forms, create and modify templates, and inject Cross-Site Scripting payloads via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.