WordPress plugin
MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 34 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical0
- High4
- Medium29
- Low1
All MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor vulnerabilities
- Medium4.3Missing Authorization
≤4.3.3Update to 4.3.4
- Medium5.3Missing Authorization
≤4.3.2Update to 4.3.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤4.3.0Update to 4.3.1
- Medium4.7Unauthenticated Arbitrary HTML Injection in Notification Emails
≤4.3.0Update to 4.3.1
- Medium5.3Unauthenticated Information Exposure
≤4.3.0Update to 4.3.1
- Medium5.34.3.0 - Unauthenticated Information Exposure
2.2.1 – 4.3.0Update to 4.3.1
- Medium5.3Unauthenticated Email Header Injection
<4.1.9Update to 4.1.9
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'mf_form_id' Widget Setting
≤4.1.8Update to 4.1.9
- Low3.7Unauthenticated Form Submission Exposure via Forgeable Cookie Value
≤4.1.0Update to 4.1.1
- Medium6.4Authenticated(Contributor+) Stored Cross-Site Scripting via `mf-template` DOM Element
≤4.0.1Update to 4.0.2
- Medium5.5Authenticated (Admin+) Server-Side Request Forgery
≤3.9.2Update to 3.9.3
- High8.1Unauthenticated Double-Extension Arbitrary File Upload
≤3.2.4Update to 3.3.0
- Medium5.3Unauthenticated Sensitive Information Exposure
≤3.8.8Update to 3.8.9
- Medium4.3Missing Authorization to Notice Dismissal
≤3.8.3Update to 3.8.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Widgets
≤3.8.5Update to 3.8.6
- Medium6.4Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode
≤3.8.3Update to 3.8.4
- Medium5.4Cross-Site Request Forgery
≤3.8.1Update to 3.8.2
- Medium5.3Missing Authorization via submit
≤3.4.0Update to 3.4.1
- Medium4.3Authenticated (Subscriber+) Information Disclosure via 'mf_first_name' shortcode
≤3.3.1Update to 3.3.2
- Medium5.4Cross-Site Request Forgery via permalink_setup
≤3.3.2Update to 3.3.3
- High8.3Unauthenticated CSV Injection
≤3.3.0Update to 3.3.1
- Medium5.4Authenticated (Contributor+) Stored Cross-Site Scripting via mf_last_name shortcode
≤3.3.0Update to 3.3.1
- Medium6.5Authenticated (Subscriber+) Information Disclosure via mf_thankyou shortcode
≤3.3.1Update to 3.3.2
- Medium4.9Authenticated (Contributor+) Stored Cross-Site Scripting via mf_thankyou shortcode
≤3.3.0Update to 3.3.1
- Medium6.5Authenticated (Subscriber+) Information Disclosure via 'mf_transaction_id' shortcode
≤3.3.1Update to 3.3.2
- Medium4.3Authenticated (Subscriber+) Information Disclosure via mf_last_name shortcode
≤3.3.1Update to 3.3.2
- Medium5.4Authenticated (Contributor+) Stored Cross-Site Scripting via mf shortcode
≤3.3.0Update to 3.3.1
- Medium6.5Authenticated (Subscriber+) Information Disclosure via mf shortcode
≤3.3.1Update to 3.3.2
- Medium4.3Authenticated (Subscriber+) Information Disclosure via 'mf_payment_status' shortcode
≤3.3.1Update to 3.3.2
- Medium5.4Authenticated (Contributor+) Stored Cross-Site Scripting via mf_first_name shortcode
≤3.3.0Update to 3.3.1
- Medium6.5Missing Authorization
≤3.3.0Update to 3.3.2
- Medium5.3reCaptcha Protection Bypass
≤3.2.1Update to 3.2.2
- High7.2Unauthenticated Stored Cross-Site Scripting
≤3.1.2Update to 3.2.0
- High7.5Sensitive Information Disclosure
≤2.1.3Update to 2.1.4
MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor: common questions
Does MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor have known vulnerabilities?
Yes. VulnCrest Radar lists 34 known vulnerabilities in MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor: 4 high, 29 medium, 1 low. None are known to affect version null.
How do I check which version of MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor vulnerability?
CVE-2026-120847, published Nov 7, 2026: MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor <= 4.3.3 - Missing Authorization. Severity: Medium (CVSS 4.3).
Is any MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor vulnerability listed in CISA KEV?
No. None of the known MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor vulnerabilities is currently listed in the CISA KEV catalog.