MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor

Уязвимости

• CVE-2023-50903без авторизации≤ 3.4.0

  WordPress Metform Elementor Contact Form Builder plugin <= 3.4.0 - Broken Access Control vulnerability

  Критич. 9.8

• CVE-2023-0714без авторизации≤ 3.2.4

  Metform Elementor Contact Form Builder <= 3.2.4 - Unauthenticated Double-Extension Arbitrary File Upload

  Критич. 9.8

• CVE-2024-33570нужен вход≤ 3.8.3

  WordPress MetForm plugin <= 3.8.3 - Broken Access Control vulnerability

  Высокий 8.8

• CVE-2023-0721без авторизации · нужен клик≤ 3.3.0

  Metform Elementor Contact Form Builder <= 3.3.0 - Unauthenticated CSV Injection

  Высокий 7.8

• CVE-2024-4266без авторизации≤ 3.8.8

  MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor <= 3.8.8 - Unauthenticated Sensitive Information Exposure

  Высокий 7.5

• CVE-2022-1442без авторизации≤ 2.1.3

  Metform Elementor Contact Form Builder <= 2.1.3 - Sensitive Information Disclosure

  Высокий 7.5

• CVE-2026-103339нужен вход≤ 4.3.0

  WordPress Metform plugin <= 4.3.0 - Cross Site Scripting (XSS) vulnerability

  Средний 6.5

• CVE-2023-0688подписчик+≤ 3.3.1

  Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via mf_thankyou shortcode

  Средний 6.5

• CVE-2026-18100участник+≤ 4.1.8

  MetForm <= 4.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'mf_form_id' Widget Setting

  Средний 6.4

• CVE-2025-5684участник+≤ 4.0.1

  MetForm <= 4.0.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via `mf-template` DOM Element

  Средний 6.4

• CVE-2023-0084без авторизации≤ 3.1.2

  Metform Elementor Contact Form Builder <= 3.1.2 - Unauthenticated Stored Cross-Site Scripting

  Средний 6.1

• CVE-2023-6788без авторизации · нужен клик≤ 3.8.1

  Metform Elementor Contact Form Builder <= 3.8.1 - Cross-Site Request Forgery

  Средний 5.4

• CVE-2024-2791участник+≤ 3.8.5

  Metform Elementor Contact Form Builder <= 3.8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widgets

  Средний 5.4

• CVE-2024-1585участник+≤ 3.8.3

  Metform Elementor Contact Form Builder <= 3.8.3 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode

  Средний 5.4

• CVE-2023-0710участник+≤ 3.3.0

  Metform Elementor Contact Form Builder <= 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via mf_thankyou shortcode

  Средний 5.4

• CVE-2023-0709участник+≤ 3.3.0

  Metform Elementor Contact Form Builder <= 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via mf_last_name shortcode

  Средний 5.4

• CVE-2023-0708участник+≤ 3.3.0

  Metform Elementor Contact Form Builder <= 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via mf_first_name shortcode

  Средний 5.4

• CVE-2023-0695участник+≤ 3.3.0

  Metform Elementor Contact Form Builder <= 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via mf shortcode

  Средний 5.4

• CVE-2023-1843без авторизации≤ 3.3.0

  Metform Elementor Contact Form Builder <= 3.3.0 - Missing Authorization

  Средний 5.3

• CVE-2023-0085без авторизации≤ 3.2.1

  Metform Elementor Contact Form Builder <= 3.2.1 - reCaptcha Protection Bypass

  Средний 5.3

• CVE-2025-30914высокие права≤ 3.9.2

  WordPress Metform Elementor Contact Form Builder plugin <= 3.9.7 - Server Side Request Forgery (SSRF) vulnerability

  Средний 4.4

• CVE-2023-2517без авторизации · нужен клик≤ 3.3.2

  Metform Elementor Contact Form Builder <= 3.3.2 - Cross-Site Request Forgery via permalink_setup

  Средний 4.3

• CVE-2023-0689подписчик+≤ 3.3.1

  Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via 'mf_first_name' shortcode

  Средний 4.3

• CVE-2023-0694подписчик+≤ 3.3.1

  Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via mf shortcode

  Средний 4.3

• CVE-2023-0693подписчик+≤ 3.3.1

  Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via 'mf_transaction_id' shortcode

  Средний 4.3

• CVE-2023-0692подписчик+≤ 3.3.1

  Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via 'mf_payment_status' shortcode

  Средний 4.3

• CVE-2023-0691подписчик+≤ 3.3.1

  Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via mf_last_name shortcode

  Средний 4.3

• CVE-2026-0633без авторизации≤ 4.1.0

  MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor <= 4.1.0 - Unauthenticated Form Submission Exposure via Forgeable Cookie Value

  Низкий 3.7