What the vulnerability does
01Description
The Metform Elementor Contact Form Builder for WordPress is vulnerable to Cross-Site Scripting by using the 'mf_last_name' shortcode to echo unescaped form submissions in versions up to, and including, 3.3.0. This allows authenticated attackers, with contributor-level permissions or above, to inject arbitrary web scripts in pages that will execute when the victim visits a a page containing the shortcode when the submission id is present in the query string. Note that getting the JavaScript to execute requires user interaction as the victim must visit a crafted link with the form entry id, but the script itself is stored in the site database.
Explanation of Vulnerability in Simple Terms
02Summary
MetForm versions up to 3.3.0 contain a stored cross-site scripting (XSS) vulnerability. An authenticated user with low privileges can inject malicious scripts into form fields. When other users view the affected form or its data, the injected script executes in their browser, potentially stealing session tokens or performing actions on their behalf. The vulnerability requires user interaction to trigger.
What an attacker can do
03Attacker Capabilities
Inject malicious scripts that execute when other users view forms or form data.
Potential impact on your site
04Site Impact
Authenticated users can compromise other users' sessions or perform unauthorized actions via stored XSS in form submissions.
Conditions required to exploit
05Prerequisites
Attacker must have a low-privilege account on the site; victim must view the affected form or data.
Key dates
06Disclosure timeline
June 9, 2023
CVE published
April 8, 2026
Record updated
