I have a client who's website I created with Wordpress. It has a contact form created with contact form 7. This client is a subsidiary of a larger organization who's IT department runs scans on their subdomains. The asked my client to protect Contact Form 7 from malicious scripts or take it down.
When I asked for an example of what they tested, my client informed me that they run tests to see if a script could be inserted into a input (ie:
<script>alert('hello');</script>) field or as a url string (ie:
With the query string, the contact form sets the action to:
Is there anything I can add to remove the possibility of running scripts in Contact Form 7?