100,000 WordPress sites using the Contact Form 7 Datepicker plugin are exposed to hack

Administrators of WordPress sites using the Contact Form 7 Datepicker plugin are recommended to remove or deactivate it to prevent attackers from exploiting a stored XSS vulnerability.