This is a link to the author on Envato. It is a strange place to put it, I agree, it is bad practice and have seen other people querying this as well.
Have scanned the sites I use it on and no malware is coming up – I wish they done a paid for version with more options, saves messing about with code. If the author can remove this and or contain it to the contact form itself, that would be great and update would be much appreciated as well.
Andrew Nevins
(@anevins)
WCLDN 2018 Contributor | Volunteer support
Thank you for highlighting this. This plugin has now been retracted from the ww.wp.xz.cn plugin repository.
