Skip to content
Noroxi

MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor

metform · plugin

Known security vulnerabilities for MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor. Find out in seconds which version runs on your site with WP Lens.

28 known vulnerabilities

2 critical · 11 exploitable without logging in · 2 with public exploit code · latest Oct 1, 2026

Listed on wordpress.org · latest 4.3.2 · last updated Oct 2, 2026 · 600K+ installs

wordpress.org status checked on Oct 2, 2026

Vulnerabilities

  • CVE-2023-50903unauthenticated≤ 3.4.0

    WordPress Metform Elementor Contact Form Builder plugin <= 3.4.0 - Broken Access Control vulnerability

    Critical 9.8

  • CVE-2023-0714unauthenticated≤ 3.2.4

    Metform Elementor Contact Form Builder <= 3.2.4 - Unauthenticated Double-Extension Arbitrary File Upload

    Critical 9.8

  • CVE-2024-33570login required≤ 3.8.3

    WordPress MetForm plugin <= 3.8.3 - Broken Access Control vulnerability

    High 8.8

  • CVE-2023-0721unauthenticated · needs a click≤ 3.3.0

    Metform Elementor Contact Form Builder <= 3.3.0 - Unauthenticated CSV Injection

    High 7.8

  • CVE-2024-4266unauthenticated≤ 3.8.8

    MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor <= 3.8.8 - Unauthenticated Sensitive Information Exposure

    High 7.5

  • CVE-2022-1442unauthenticated≤ 2.1.3

    Metform Elementor Contact Form Builder <= 2.1.3 - Sensitive Information Disclosure

    High 7.5

  • CVE-2026-103339login required≤ 4.3.0

    WordPress Metform plugin <= 4.3.0 - Cross Site Scripting (XSS) vulnerability

    Medium 6.5

  • CVE-2023-0688subscriber+≤ 3.3.1

    Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via mf_thankyou shortcode

    Medium 6.5

  • CVE-2026-18100contributor+≤ 4.1.8

    MetForm <= 4.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'mf_form_id' Widget Setting

    Medium 6.4

  • CVE-2025-5684contributor+≤ 4.0.1

    MetForm <= 4.0.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via `mf-template` DOM Element

    Medium 6.4

  • CVE-2023-0084unauthenticated≤ 3.1.2

    Metform Elementor Contact Form Builder <= 3.1.2 - Unauthenticated Stored Cross-Site Scripting

    Medium 6.1

  • CVE-2023-6788unauthenticated · needs a click≤ 3.8.1

    Metform Elementor Contact Form Builder <= 3.8.1 - Cross-Site Request Forgery

    Medium 5.4

  • CVE-2024-2791contributor+≤ 3.8.5

    Metform Elementor Contact Form Builder <= 3.8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widgets

    Medium 5.4

  • CVE-2024-1585contributor+≤ 3.8.3

    Metform Elementor Contact Form Builder <= 3.8.3 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode

    Medium 5.4

  • CVE-2023-0710contributor+≤ 3.3.0

    Metform Elementor Contact Form Builder <= 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via mf_thankyou shortcode

    Medium 5.4

  • CVE-2023-0709contributor+≤ 3.3.0

    Metform Elementor Contact Form Builder <= 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via mf_last_name shortcode

    Medium 5.4

  • CVE-2023-0708contributor+≤ 3.3.0

    Metform Elementor Contact Form Builder <= 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via mf_first_name shortcode

    Medium 5.4

  • CVE-2023-0695contributor+≤ 3.3.0

    Metform Elementor Contact Form Builder <= 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via mf shortcode

    Medium 5.4

  • CVE-2023-1843unauthenticated≤ 3.3.0

    Metform Elementor Contact Form Builder <= 3.3.0 - Missing Authorization

    Medium 5.3

  • CVE-2023-0085unauthenticated≤ 3.2.1

    Metform Elementor Contact Form Builder <= 3.2.1 - reCaptcha Protection Bypass

    Medium 5.3

  • CVE-2025-30914high privilege≤ 3.9.2

    WordPress Metform Elementor Contact Form Builder plugin <= 3.9.7 - Server Side Request Forgery (SSRF) vulnerability

    Medium 4.4

  • CVE-2023-2517unauthenticated · needs a click≤ 3.3.2

    Metform Elementor Contact Form Builder <= 3.3.2 - Cross-Site Request Forgery via permalink_setup

    Medium 4.3

  • CVE-2023-0689subscriber+≤ 3.3.1

    Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via 'mf_first_name' shortcode

    Medium 4.3

  • CVE-2023-0694subscriber+≤ 3.3.1

    Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via mf shortcode

    Medium 4.3

  • CVE-2023-0693subscriber+≤ 3.3.1

    Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via 'mf_transaction_id' shortcode

    Medium 4.3

  • CVE-2023-0692subscriber+≤ 3.3.1

    Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via 'mf_payment_status' shortcode

    Medium 4.3

  • CVE-2023-0691subscriber+≤ 3.3.1

    Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via mf_last_name shortcode

    Medium 4.3

  • CVE-2026-0633unauthenticated≤ 4.1.0

    MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor <= 4.1.0 - Unauthenticated Form Submission Exposure via Forgeable Cookie Value

    Low 3.7

The access label is read from the record's own text (e.g. “subscriber+”: subscriber and above). When the text names no role, CVSS decides between “login required” and “high privilege”; no role name is invented. “Needs a click”: the attack depends on a logged-in user following a link (CSRF, reflected XSS).

← Back to directory