CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
What the vulnerability does
The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via text areas on forms in versions up to, and including, 3.1.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page, which is the submissions page.
Explanation of Vulnerability in Simple Terms
MetForm versions up to 3.1.2 contain a stored cross-site scripting (XSS) vulnerability that allows unauthenticated attackers to inject malicious scripts into form fields. These scripts execute in the browsers of site visitors and administrators who view the submitted form data. The vulnerability affects the form builder's handling of user input without proper sanitization.
What an attacker can do
Inject malicious JavaScript that runs when site visitors or admins view form submissions.
Potential impact on your site
Visitor and admin accounts can be compromised; site data and credentials may be stolen.
Conditions required to exploit
No authentication required. Attacker can submit a form with malicious payload directly.
Key dates
External resources
Related vulnerabilities
