Html tags are still being added.
I change the following code in the wavt_validation_php.php
return str_replace("<","<",str_replace(">",">",str_replace('"',""",$retVal)));
to
return htmlspecialchars($retVal);
When I type in test and entered an invalid captcha security code I get the following:
<p>test</p>