MetForm - Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor vulnerabilities

Known security issues in the MetForm - Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor WordPress plugin, by affected version, with severity, CVE and the version that fixes each one.

Plugin slug: metform
Latest version: 4.3.2
Active installs: 600,000+
Known vulnerabilities: 32
Data updated: 2026-10-17 06:30 UTC

View on wordpress.org

Check your version

This information comes from public vulnerability databases and may be incomplete or out of date. A plugin with no known vulnerabilities is not proof that it is secure; keep plugins updated and remove the ones you do not use.

Fixed in version 4.3.1 (4)

MetForm - Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor: Fixed in version 4.3.1
Vulnerability	Severity	CVSS	Affected versions	Published
MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor <= 4.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2026-103339 · Source	Medium	6.5	< 4.3.1	2026-10-01
[en] The MetForm WordPress plugin before 4.3.1 does not sanitize or escape submitted form-field values before inserting them into the HTML body of its email notifications, allowing unauthenticated attackers to inject arbitrary markup into t CVE-2026-86833 · Source	Medium	5.4	< 4.3.1	2026-10-07
MetForm <= 4.3.0 - Unauthenticated Information Exposure CVE-2026-86832 · Source	Not rated	-	< 4.3.1	2026-10-01
MetForm 2.2.1 - 4.3.0 - Unauthenticated Information Exposure CVE-2026-86834 · Source	Not rated	-	>= 2.2.1 and < 4.3.1	2026-10-01

Fixed in version 4.1.9 (2)

MetForm - Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor: Fixed in version 4.1.9
Vulnerability	Severity	CVSS	Affected versions	Published
MetForm <= 4.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'mf_form_id' Widget Setting CVE-2026-18100 · Source	Medium	6.4	< 4.1.9	2026-01-23
MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor < 4.1.9 - Unauthenticated Email Header Injection CVE-2026-86813 · Source	Medium	4.8	< 4.1.9	2026-08-24

Fixed in version 4.1.1 (1)

MetForm - Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor: Fixed in version 4.1.1
Vulnerability	Severity	CVSS	Affected versions	Published
MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor <= 4.1.0 - Unauthenticated Form Submission Exposure via Forgeable Cookie Value CVE-2026-0633 · Source	Not rated	-	< 4.1.1	0000-00-00

Fixed in version 4.0.2 (1)

MetForm - Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor: Fixed in version 4.0.2
Vulnerability	Severity	CVSS	Affected versions	Published
MetForm <= 4.0.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via `mf-template` DOM Element CVE-2025-5684 · Source	Medium	6.4	< 4.0.2	0000-00-00

Fixed in version 3.9.3 (1)

MetForm - Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor: Fixed in version 3.9.3
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Metform Plugin <= 3.9.2 is vulnerable to Server Side Request Forgery (SSRF) CVE-2025-30914 · Source	Low	0.0	< 3.9.3	2025-03-27

Fixed in version 3.8.9 (1)

MetForm - Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor: Fixed in version 3.8.9
Vulnerability	Severity	CVSS	Affected versions	Published
MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor <= 3.8.8 - Unauthenticated Sensitive Information Exposure CVE-2024-4266 · Source	High	7.5	< 3.8.9	2024-06-10

Fixed in version 3.8.6 (1)

MetForm - Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor: Fixed in version 3.8.6
Vulnerability	Severity	CVSS	Affected versions	Published
Metform Elementor Contact Form Builder <= 3.8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widgets CVE-2024-2791 · Source	Medium	5.4	< 3.8.6	2024-04-01

Fixed in version 3.8.4 (2)

MetForm - Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor: Fixed in version 3.8.4
Vulnerability	Severity	CVSS	Affected versions	Published
Metform Elementor Contact Form Builder <= 3.8.3 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode CVE-2024-1585 · Source	Medium	5.4	< 3.8.4	2024-03-07
WordPress Metform Elementor Contact Form Builder Plugin <= 3.8.3 is vulnerable to Broken Access Control CVE-2024-33570 · Source	Medium	4.3	< 3.8.4	2024-04-25

Fixed in version 3.8.2 (1)

MetForm - Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor: Fixed in version 3.8.2
Vulnerability	Severity	CVSS	Affected versions	Published
Metform Elementor Contact Form Builder <= 3.8.1 - Cross-Site Request Forgery CVE-2023-6788 · Source	Medium	5.4	< 3.8.2	2024-01-08

Fixed in version 3.4.1 (1)

MetForm - Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor: Fixed in version 3.4.1
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Metform Elementor Contact Form Builder Plugin <= 3.4.0 is vulnerable to Broken Access Control CVE-2023-50903 · Source	Medium	5.3	< 3.4.1	2023-12-26

Fixed in version 3.3.3 (1)

MetForm - Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor: Fixed in version 3.3.3
Vulnerability	Severity	CVSS	Affected versions	Published
Metform Elementor Contact Form Builder <= 3.3.2 - Cross-Site Request Forgery via permalink_setup CVE-2023-2517 · Source	Medium	4.3	< 3.3.3	2023-06-22

Fixed in version 3.3.2 (6)

MetForm - Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor: Fixed in version 3.3.2
Vulnerability	Severity	CVSS	Affected versions	Published
Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via mf_thankyou shortcode CVE-2023-0688 · Source	Medium	6.5	< 3.3.2	2023-06-08
Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via 'mf_first_name' shortcode CVE-2023-0689 · Source	Medium	4.3	< 3.3.2	2023-08-30
Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via mf_last_name shortcode CVE-2023-0691 · Source	Medium	4.3	< 3.3.2	2023-06-08
Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via 'mf_transaction_id' shortcode CVE-2023-0693 · Source	Medium	4.3	< 3.3.2	2023-06-08
Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via mf shortcode CVE-2023-0694 · Source	Medium	4.3	< 3.3.2	2023-06-08
Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via 'mf_payment_status' shortcode CVE-2023-0692 · Source	Medium	4.3	< 3.3.2	2023-06-08

Fixed in version 3.3.1 (6)

MetForm - Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor: Fixed in version 3.3.1
Vulnerability	Severity	CVSS	Affected versions	Published
Metform Elementor Contact Form Builder <= 3.3.0 - Unauthenticated CSV Injection CVE-2023-0721 · Source	High	7.8	< 3.3.1	2023-06-08
Metform Elementor Contact Form Builder <= 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via mf_thankyou shortcode CVE-2023-0710 · Source	Medium	5.4	< 3.3.1	2023-06-08
Metform Elementor Contact Form Builder <= 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via mf_last_name shortcode CVE-2023-0709 · Source	Medium	5.4	< 3.3.1	2023-06-08
Metform Elementor Contact Form Builder <= 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via mf_first_name shortcode CVE-2023-0708 · Source	Medium	5.4	< 3.3.1	2023-06-08
Metform Elementor Contact Form Builder <= 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via mf shortcode CVE-2023-0695 · Source	Medium	5.4	< 3.3.1	2023-06-08
Metform Elementor Contact Form Builder <= 3.3.0 - Missing Authorization CVE-2023-1843 · Source	Medium	5.3	< 3.3.1	2023-05-04

Fixed in version 3.3.0 (1)

MetForm - Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor: Fixed in version 3.3.0
Vulnerability	Severity	CVSS	Affected versions	Published
Metform Elementor Contact Form Builder <= 3.2.4 - Unauthenticated Double-Extension Arbitrary File Upload CVE-2023-0714 · Source	Critical	9.8	< 3.3.0	2024-08-16

Fixed in version 3.2.2 (1)

MetForm - Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor: Fixed in version 3.2.2
Vulnerability	Severity	CVSS	Affected versions	Published
Metform Elementor Contact Form Builder <= 3.2.1 - reCaptcha Protection Bypass CVE-2023-0085 · Source	Medium	5.3	< 3.2.2	2023-03-02

Fixed in version 3.2.0 (2)

MetForm - Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor: Fixed in version 3.2.0
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Metform Elementor Contact Form Builder plugin <= 2.1.3 - Unauthenticated API keys and Secrets Disclosure vulnerability CVE-2022-1442 · Source	High	7.5	< 3.2.0	2022-04-23
Metform Elementor Contact Form Builder <= 3.1.2 - Unauthenticated Stored Cross-Site Scripting CVE-2023-0084 · Source	Medium	6.1	< 3.2.0	2023-02-02

Check every plugin on your site automatically

Install the free Webforta WordPress Security plugin and Webforta matches every plugin, theme and WordPress version you run against known vulnerabilities, and tells you when a new one affects your site.

Start free About the WordPress plugin

Sources and attribution

Vulnerability data from WPVulnerability (WordPress, plugins, themes and server software). WPVulnerability data license.
CVE records are copyright The MITRE Corporation. CVE Terms of Use.
Known-exploited status from the CISA Known Exploited Vulnerabilities catalog. Public domain (U.S. Government work).
Plugin names, latest versions and install counts from the WordPress.org plugin directory. WordPress is a trademark of the WordPress Foundation; Webforta is not affiliated with or endorsed by WordPress.org, WPVulnerability or the sources above.