Metform Vulnerabilities

The MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'mf_form_id' Widget Setting in all versions up to, and including, 4.1.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVSS:

6.4

Affected:

up to 4.1.8

Fixed in:

4.1.9

Disclosed:

Aug 24, 2026

CVE-2026-18100 on NVD →

The MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 4.1.0. This is due to the use of a forgeable cookie value derived only from the entry ID and current user ID without a server-side secret....

CVSS:

3.7

Affected:

up to 4.1.0

Fixed in:

4.1.1

Disclosed:

Jan 23, 2026

CVE-2026-0633 on NVD →

The MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `mf-template` DOM Element in all versions up to, and including, 4.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticat...

CVSS:

6.4

Affected:

up to 4.0.1

Fixed in:

4.0.2

Disclosed:

Jul 29, 2025

CVE-2025-5684 on NVD →

The MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.9.2. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary lo...

CVSS:

5.5

Affected:

up to 3.9.2

Fixed in:

3.9.3

Disclosed:

Mar 27, 2025

CVE-2025-30914 on NVD →

[en] Server-Side Request Forgery (SSRF) vulnerability in XpeedStudio Metform allows Server Side Request Forgery. This issue affects Metform: from n/a through 3.9.2.

Affected:

up to 3.9.3

Fixed in:

3.9.3

Disclosed:

Mar 27, 2025

CVE-2025-30914 on NVD →

[en] Missing Authorization vulnerability in Wpmet Metform Elementor Contact Form Builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Metform Elementor Contact Form Builder: from n/a through 3.4.0.

Affected:

up to 3.4.1

Fixed in:

3.4.1

Disclosed:

Dec 9, 2024

CVE-2023-50903 on NVD →

[en] The Metform Elementor Contact Form Builder for WordPress is vulnerable to Arbitrary File Upload due to insufficient file type validation in versions up to, and including, 3.2.4. This allows unauthenticated visitors to perform a "double extension" attack and upload files containing a malicious extension but ending...

Affected:

up to 3.3.0

Fixed in:

3.3.0

Disclosed:

Aug 17, 2024

CVE-2023-0714 on NVD →

The Metform Elementor Contact Form Builder for WordPress is vulnerable to Arbitrary File Upload due to insufficient file type validation in versions up to, and including, 3.2.4. This allows unauthenticated visitors to perform a "double extension" attack and upload files containing a malicious extension but ending with...

CVSS:

8.1

Affected:

up to 3.2.4

Fixed in:

3.3.0

Disclosed:

Aug 16, 2024

CVE-2023-0714 on NVD →

[en] The MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 3.8.8 via the 'handle_file' function. This can allow unauthenticated attackers to extract sensitive data, such as Personally Identifia...

Affected:

up to 3.8.9

Fixed in:

3.8.9

Disclosed:

Jun 11, 2024

CVE-2024-4266 on NVD →

The MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 3.8.8 via the 'handle_file' function. This can allow unauthenticated attackers to extract sensitive data, such as Personally Identifiable I...

CVSS:

5.3

Affected:

up to 3.8.8

Fixed in:

3.8.9

Disclosed:

Jun 10, 2024

CVE-2024-4266 on NVD →

[en] Missing Authorization vulnerability in Wpmet Metform Elementor Contact Form Builder.This issue affects Metform Elementor Contact Form Builder: from n/a through 3.8.3.

Affected:

up to 3.8.4

Fixed in:

3.8.4

Disclosed:

May 6, 2024

CVE-2024-33570 on NVD →

The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the dismiss_ajax_call function in versions up to, and including, 3.8.3. This makes it possible for authenticated attackers, with subscriber-level access and above, to d...

CVSS:

4.3

Affected:

up to 3.8.3

Fixed in:

3.8.4

Disclosed:

Apr 25, 2024

CVE-2024-33570 on NVD →

[en] The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions up to, and including, 3.8.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attacker...

Affected:

up to 3.8.6

Fixed in:

3.8.6

Disclosed:

Apr 2, 2024

CVE-2024-2791 on NVD →

The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions up to, and including, 3.8.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, wi...

CVSS:

6.4

Affected:

up to 3.8.5

Fixed in:

3.8.6

Disclosed:

Apr 1, 2024

CVE-2024-2791 on NVD →

[en] The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 3.8.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated att...

Affected:

up to 3.8.4

Fixed in:

3.8.4

Disclosed:

Mar 13, 2024

CVE-2024-1585 on NVD →

The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 3.8.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attacker...

CVSS:

6.4

Affected:

up to 3.8.3

Fixed in:

3.8.4

Disclosed:

Mar 7, 2024

CVE-2024-1585 on NVD →

[en] The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.8.1. This is due to missing or incorrect nonce validation on the contents function. This makes it possible for unauthenticated attackers to update the options "mf_hubs...

Affected:

up to 3.8.2

Fixed in:

3.8.2

Disclosed:

Jan 9, 2024

CVE-2023-6788 on NVD →

The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.8.1. This is due to missing or incorrect nonce validation on the contents function. This makes it possible for unauthenticated attackers to update the options "mf_hubsopt_t...

CVSS:

5.4

Affected:

up to 3.8.1

Fixed in:

3.8.2

Disclosed:

Jan 8, 2024

CVE-2023-6788 on NVD →

The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'submit' function in versions up to, and including, 3.4.0. This makes it possible for unauthenticated attackers to enter form submissions for forms that are in tras...

CVSS:

5.3

Affected:

up to 3.4.0

Fixed in:

3.4.1

Disclosed:

Dec 26, 2023

CVE-2023-50903 on NVD →

[en] The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf_first_name' shortcode in versions up to, and including, 3.3.1. This allows authenticated attackers, with subscriber-level capabilities or above to obtain sensitive information about arbitrary form submissio...

Affected:

up to 3.3.2

Fixed in:

3.3.2

Disclosed:

Aug 31, 2023

CVE-2023-0689 on NVD →

The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf_first_name' shortcode in versions up to, and including, 3.3.1. This allows authenticated attackers, with subscriber-level capabilities or above to obtain sensitive information about arbitrary form submissions, i...

CVSS:

4.3

Affected:

up to 3.3.1

Fixed in:

3.3.2

Disclosed:

Aug 30, 2023

CVE-2023-0689 on NVD →

[en] The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.3.2. This is due to missing or incorrect nonce validation on the permalink_setup function. This makes it possible for unauthenticated attackers to change the permalink str...

Affected:

up to 3.3.3

Fixed in:

3.3.3

Disclosed:

Jul 12, 2023

CVE-2023-2517 on NVD →

The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.3.2. This is due to missing or incorrect nonce validation on the permalink_setup function. This makes it possible for unauthenticated attackers to change the permalink structur...

CVSS:

5.4

Affected:

up to 3.3.2

Fixed in:

3.3.3

Disclosed:

Jun 22, 2023

CVE-2023-2517 on NVD →

[en] The Metform Elementor Contact Form Builder for WordPress is vulnerable to Cross-Site Scripting by using the 'mf_last_name' shortcode to echo unescaped form submissions in versions up to, and including, 3.3.0. This allows authenticated attackers, with contributor-level permissions or above, to inject arbitrary web...

Affected:

up to 3.3.1

Fixed in:

3.3.1

Disclosed:

Jun 9, 2023

CVE-2023-0709 on NVD →

[en] The Metform Elementor Contact Form Builder for WordPress is vulnerable to Cross-Site Scripting by using the 'fname' attribute of the 'mf_thankyou' shortcode to echo unescaped form submissions in versions up to, and including, 3.3.0. This allows authenticated attackers, with contributor-level permissions or above,...

Affected:

up to 3.3.1

Fixed in:

3.3.1

Disclosed:

Jun 9, 2023

CVE-2023-0710 on NVD →

[en] The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf_thankyou' shortcode in versions up to, and including, 3.3.1. This allows authenticated attackers, with subscriber-level capabilities or above to obtain sensitive information about form submissions, includin...

Affected:

up to 3.3.2

Fixed in:

3.3.2

Disclosed:

Jun 9, 2023

CVE-2023-0688 on NVD →

[en] The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf' shortcode in versions up to, and including, 3.3.1. This allows authenticated attackers, with subscriber-level capabilities or above to obtain sensitive information about any standard form field of any form...

Affected:

up to 3.3.2

Fixed in:

3.3.2

Disclosed:

Jun 9, 2023

CVE-2023-0694 on NVD →

[en] The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf_transaction_id' shortcode in versions up to, and including, 3.3.1. This allows authenticated attackers, with subscriber-level capabilities or above to obtain sensitive information about the transaction ids...

Affected:

up to 3.3.2

Fixed in:

3.3.2

Disclosed:

Jun 9, 2023

CVE-2023-0693 on NVD →

[en] The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf_last_name' shortcode in versions up to, and including, 3.3.1. This allows authenticated attackers, with subscriber-level capabilities or above to obtain sensitive information about arbitrary form submission...

Affected:

up to 3.3.2

Fixed in:

3.3.2

Disclosed:

Jun 9, 2023

CVE-2023-0691 on NVD →

[en] The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to unauthorized permalink structure update due to a missing capability check on the permalink_setup function in versions up to, and including, 3.3.0. This makes it possible for unauthenticated attackers to change the permalink structure.

Affected:

up to 3.3.1

Fixed in:

3.3.1

Disclosed:

Jun 9, 2023

CVE-2023-1843 on NVD →

[en] The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf_payment_status' shortcode in versions up to, and including, 3.3.1. This allows authenticated attackers, with subscriber-level capabilities or above to obtain sensitive information about the payment status o...

Affected:

up to 3.3.2

Fixed in:

3.3.2

Disclosed:

Jun 9, 2023

CVE-2023-0692 on NVD →

[en] The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to CSV injection in versions up to, and including, 3.3.0. This allows unauthenticated attackers to embed untrusted input into exported CSV files, which can result in code execution when these files are downloaded and opened on a local sy...

Affected:

up to 3.3.1

Fixed in:

3.3.1

Disclosed:

Jun 9, 2023

CVE-2023-0721 on NVD →

[en] The Metform Elementor Contact Form Builder for WordPress is vulnerable to Cross-Site Scripting by using the 'mf_first_name' shortcode to echo unescaped form submissions in versions up to, and including, 3.3.0. This allows authenticated attackers, with contributor-level permissions or above, to inject arbitrary web...

Affected:

up to 3.3.1

Fixed in:

3.3.1

Disclosed:

Jun 9, 2023

CVE-2023-0708 on NVD →

[en] The Metform Elementor Contact Form Builder for WordPress is vulnerable to Cross-Site Scripting by using the 'mf' shortcode to echo unescaped form submissions in versions up to, and including, 3.3.0. This allows authenticated attackers, with contributor-level permissions or above, to inject arbitrary web scripts in...

Affected:

up to 3.3.1

Fixed in:

3.3.1

Disclosed:

Jun 9, 2023

CVE-2023-0695 on NVD →

The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to CSV injection in versions up to, and including, 3.3.0. This allows unauthenticated attackers to embed untrusted input into exported CSV files, which can result in code execution when these files are downloaded and opened on a local system...

CVSS:

8.3

Affected:

up to 3.3.0

Fixed in:

3.3.1

Disclosed:

Jun 8, 2023

CVE-2023-0721 on NVD →

The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf' shortcode in versions up to, and including, 3.3.1. This allows authenticated attackers, with subscriber-level capabilities or above to obtain sensitive information about any standard form field of any form subm...

CVSS:

6.5

Affected:

up to 3.3.1

Fixed in:

3.3.2

Disclosed:

Jun 8, 2023

CVE-2023-0694 on NVD →

The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf_thankyou' shortcode in versions up to, and including, 3.3.1. This allows authenticated attackers, with subscriber-level capabilities or above to obtain sensitive information about form submissions, including pay...

CVSS:

6.5

Affected:

up to 3.3.1

Fixed in:

3.3.2

Disclosed:

Jun 8, 2023

CVE-2023-0688 on NVD →

The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf_transaction_id' shortcode in versions up to, and including, 3.3.1. This allows authenticated attackers, with subscriber-level capabilities or above to obtain sensitive information about the transaction ids of ar...

CVSS:

6.5

Affected:

up to 3.3.1

Fixed in:

3.3.2

Disclosed:

Jun 8, 2023

CVE-2023-0693 on NVD →

The Metform Elementor Contact Form Builder for WordPress is vulnerable to Cross-Site Scripting by using the 'mf_first_name' shortcode to echo unescaped form submissions in versions up to, and including, 3.3.0. This allows authenticated attackers, with contributor-level permissions or above, to inject arbitrary web scri...

CVSS:

5.4

Affected:

up to 3.3.0

Fixed in:

3.3.1

Disclosed:

Jun 8, 2023

CVE-2023-0708 on NVD →

The Metform Elementor Contact Form Builder for WordPress is vulnerable to Cross-Site Scripting by using the 'mf_last_name' shortcode to echo unescaped form submissions in versions up to, and including, 3.3.0. This allows authenticated attackers, with contributor-level permissions or above, to inject arbitrary web scrip...

CVSS:

5.4

Affected:

up to 3.3.0

Fixed in:

3.3.1

Disclosed:

Jun 8, 2023

CVE-2023-0709 on NVD →

The Metform Elementor Contact Form Builder for WordPress is vulnerable to Cross-Site Scripting by using the 'mf' shortcode to echo unescaped form submissions in versions up to, and including, 3.3.0. This allows authenticated attackers, with contributor-level permissions or above, to inject arbitrary web scripts in page...

CVSS:

5.4

Affected:

up to 3.3.0

Fixed in:

3.3.1

Disclosed:

Jun 8, 2023

CVE-2023-0695 on NVD →

The Metform Elementor Contact Form Builder for WordPress is vulnerable to Cross-Site Scripting by using the 'fname' attribute of the 'mf_thankyou' shortcode to echo unescaped form submissions in versions up to, and including, 3.3.0. This allows authenticated attackers, with contributor-level permissions or above, to in...

CVSS:

4.9

Affected:

up to 3.3.0

Fixed in:

3.3.1

Disclosed:

Jun 8, 2023

CVE-2023-0710 on NVD →

The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf_payment_status' shortcode in versions up to, and including, 3.3.1. This allows authenticated attackers, with subscriber-level capabilities or above to obtain sensitive information about the payment status of arb...

CVSS:

4.3

Affected:

up to 3.3.1

Fixed in:

3.3.2

Disclosed:

Jun 8, 2023

CVE-2023-0692 on NVD →

The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf_last_name' shortcode in versions up to, and including, 3.3.1. This allows authenticated attackers, with subscriber-level capabilities or above to obtain sensitive information about arbitrary form submissions, sp...

CVSS:

4.3

Affected:

up to 3.3.1

Fixed in:

3.3.2

Disclosed:

Jun 8, 2023

CVE-2023-0691 on NVD →

The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to unauthorized permalink structure update due to a missing capability check on the permalink_setup function in versions up to, and including, 3.3.0. This makes it possible for unauthenticated attackers to change the permalink structure.

CVSS:

6.5

Affected:

up to 3.3.0

Fixed in:

3.3.2

Disclosed:

May 4, 2023

CVE-2023-1843 on NVD →

The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to reCaptcha Bypass in versions up to, and including, 3.2.1. This is due to insufficient server side checking on the captcha value submitted during a form submission. This makes it possible for unauthenticated attackers to bypass Captcha rest...

CVSS:

5.3

Affected:

up to 3.2.1

Fixed in:

3.2.2

Disclosed:

Mar 2, 2023

CVE-2023-0085 on NVD →

[en] The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to reCaptcha Bypass in versions up to, and including, 3.2.1. This is due to insufficient server side checking on the captcha value submitted during a form submission. This makes it possible for unauthenticated attackers to bypass Captcha...

Affected:

up to 3.2.2

Fixed in:

3.2.2

Disclosed:

Mar 2, 2023

CVE-2023-0085 on NVD →

[en] The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via text areas on forms in versions up to, and including, 3.1.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scrip...

Affected:

up to 3.2.0

Fixed in:

3.2.0

Disclosed:

Mar 2, 2023

CVE-2023-0084 on NVD →

The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via text areas on forms in versions up to, and including, 3.1.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in...

CVSS:

7.2

Affected:

up to 3.1.2

Fixed in:

3.2.0

Disclosed:

Feb 2, 2023

CVE-2023-0084 on NVD →

[en] The Metform WordPress plugin is vulnerable to sensitive information disclosure due to improper access control in the ~/core/forms/action.php file which can be exploited by an unauthenticated attacker to view all API keys and secrets of integrated third-party APIs like that of PayPal, Stripe, Mailchimp, Hubspot, He...

Affected:

up to 3.2.0

Fixed in:

3.2.0

Disclosed:

May 10, 2022

CVE-2022-1442 on NVD →

The Metform WordPress plugin is vulnerable to sensitive information disclosure due to improper access control in the ~/core/forms/action.php file which can be exploited by an unauthenticated attacker to view all API keys and secrets of integrated third-party APIs like that of PayPal, Stripe, Mailchimp, Hubspot, HelpSco...

CVSS:

7.5

Affected:

up to 2.1.3

Fixed in:

2.1.4

Disclosed:

Apr 23, 2022

CVE-2022-1442 on NVD →

Affected:

up to 4.0.2

Fixed in:

4.0.2

CVE-2025-5684 on NVD →