Administrator-session script execution via stored form fields

Stored XSS in Paymattic before 4.2.1 allows remote attackers to execute scripts in an administrator's browser through submitted forms. The plugin stores unescaped Name, Subject, and Message field values and renders them in the administrative entry view without sanitization or output encoding. No account is required; execution occurs when an administrator opens the malicious submission, allowing script access within that administrator session.