MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor <= 4.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget Settings

ID

WPSEC-2026-0013

Plugin

MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor (metform)

Affected

all versions before 4.3.1

Remediation

Update to 4.3.1 or later.

CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Weakness

CWE-79

Usage

Plugin High · Affected versions Medium among sites WPSec scans, 2026-10-22

Attack surface

MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor on WPSec AttackSurface

Fix released

2026-09-30

Published

2026-10-01

Description

The MetForm plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form widget settings and field names in all versions up to, and including, 4.3.0 due to insufficient escaping of values placed inside a JavaScript template literal that is compiled at runtime: backticks and ${ } template expressions were not escaped. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page, for example by embedding their own Elementor draft containing MetForm field widgets through the [metform] shortcode, which did not check the post type.

References

• https://wpsec.com/vuln/WPSEC-2026-0013/
• https://plugins.svn.wordpress.org/metform/tags/4.3.1/
• https://wordpress.org/plugins/metform/

Published by WPSec. Provided as is, without warranty. Corrections: contact us.

This advisory as JSON or Markdown · All advisories: JSON, RSS