WordPress Plugin Vulnerabilities

MetForm < 4.3.1 - Contributor+ Stored XSS

Description

The plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Affects Plugins

Plugin icon
metform
Fixed in 4.3.1

References

CVE
CVE-2026-103339
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/58d56f30-6897-4132-aea8-de2cb11170ed

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
5.5 (Medium)

Miscellaneous

Original Researcher
Intrudify
Verified
No
WPVDB ID
09c6aa98-deab-416b-919c-4fd6c0655668

Timeline

Publicly Published
2026-10-01 (about 16 days ago)
Added
2026-10-09 (about 8 days ago)
Last Updated
2026-10-09 (about 8 days ago)

Other

Published
Title
Published
2024-06-18
Title
OSM Map Widget for Elementor < 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter
Published
2024-11-14
Title
Tripetto <= 8.0.6 - Unauthentiated Stored Cross-Site Scripting via Form File Upload
Published
2024-06-10
Title
Custom Field Template < 2.6.2 - Authenticated(Constibutor+) Stored Cross-Site Scripting via Custom Field Name
Published
2016-06-07
Title
Wordpress Levo-Slideshow 2.3 - Stored Cross-Site Scripting (XSS)
Published
2025-03-31
Title
Elfsight Testimonials Slider <= 1.0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting