Plugin icon

MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor

metform

Vulnerabilities:

17

Last Updated:

January 14, 2026

Active Installs:

600000

Published
Title
Fixed in
CVSS
Published
2025-07-29
Title
MetForm < 4.0.2 - Contributor+ Stored XSS via mf-template DOM Element
Fixed in
Fixed in 4.0.2
CVSS
5.9 (medium)
Published
2025-03-27
Title
Metform < 3.9.3 - Admin+ SSRF
Fixed in
Fixed in 3.9.3
CVSS
4.1 (medium)
Published
2024-08-16
Title
Metform Elementor Contact Form Builder < 3.3.0 - Unauthenticated Double-Extension Arbitrary File Upload
Fixed in
Fixed in 3.3.0
CVSS
8.1 (high)
Published
2024-06-10
Title
MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor < 3.8.9 - Unauthenticated Sensitive Information Exposure
Fixed in
Fixed in 3.8.9
CVSS
5.3 (medium)
Published
2024-04-25
Title
Metform Elementor Contact Form Builder < 3.8.4 - Missing Authorization to Notice Dismissal
Fixed in
Fixed in 3.8.4
CVSS
4.3 (medium)
Published
2024-04-01
Title
Metform Elementor Contact Form Builder < 3.8.6 - Contributor+ Stored XSS
Fixed in
Fixed in 3.8.6
CVSS
5.9 (medium)
Published
2024-03-07
Title
Metform Elementor Contact Form Builder < 3.8.4 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode
Fixed in
Fixed in 3.8.4
CVSS
6.4 (medium)
Published
2024-01-08
Title
Metform Elementor Contact Form Builder < 3.8.2 - Cross-Site Request Forgery
Fixed in
Fixed in 3.8.2
CVSS
5.4 (medium)
Published
2023-08-30
Title
Metform Elementor Contact Form Builder < 3.3.2 - Authenticated (Subscriber+) Information Disclosure via 'mf_first_name' shortcode
Fixed in
Fixed in 3.3.2
CVSS
4.3 (medium)
Published
2023-06-22
Title
Metform Elementor Contact Form Builder < 3.3.3 - Cross-Site Request Forgery
Fixed in
Fixed in 3.3.3
CVSS
5.4 (medium)
Published
2023-06-08
Title
Metform Elementor Contact Form Builder < 3.3.1 - Unauthenticated CSV Injection
Fixed in
Fixed in 3.3.1
CVSS
8.3 (high)
Published
2023-06-08
Title
Metform Elementor Contact Form Builder < 3.3.2 - Multiple Subscriber+ Sensitive Information Disclosure Issues
Fixed in
Fixed in 3.3.2
CVSS
6.5 (medium)
Published
2023-06-08
Title
Metform Elementor Contact Form Builder < 3.3.1 - Multiple Contributor+ Stored XSS via Shortcode
Fixed in
Fixed in 3.3.1
CVSS
6.8 (medium)
Published
2023-05-04
Title
Metform Elementor Contact Form Builder < 3.3.2 - Unauthenticated Permalink Structure Update
Fixed in
Fixed in 3.3.2
CVSS
6.5 (medium)
Published
2023-03-02
Title
Metform Elementor Contact Form Builder < 3.2.2 - reCaptcha Bypass
Fixed in
Fixed in 3.2.2
CVSS
5.3 (medium)
Published
2023-02-03
Title
Metform Elementor Contact Form Builder < 3.2.0 - Unauthenticated Stored XSS
Fixed in
Fixed in 3.2.0
CVSS
7.5 (high)
Published
2022-04-23
Title
Metform Elementor Contact Form Builder < 2.1.4 - Unauthenticated API keys and Secrets Disclosure
Fixed in
Fixed in 2.1.4
CVSS
7.5 (high)