wingerspeed vulnerabilities and threats

The Slim Jetpack WordPress plugin up to version 2.7.0.1 is vulnerable to stored Cross-Site Scripting (XSS) via the 'g<PAGE_ID>-website' contact-field parameter. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts that execute when users access affected pages. The plugin's nonce and authentication checks apply only to logged-in users, enabling unauthenticated visitors to store payloads through pages containing the [contact-form] shortcode.