Plugin vulnerabilities
Is MetForm safe? Known vulnerabilities and the version to run.
MetForm: a form builder for Elementor, covering contact forms, surveys and quizzes.
The short answer
Run MetForm 4.3.4 or later. That version has a fix for every known vulnerability that's been patched.
- Known vulnerabilities
- 33
- In the last 12 months
- 9
- Rated high or critical
- 4
- No fix yet
- 0
Every known MetForm vulnerability
Newest first. The most recent was disclosed on 7 November 2026. Each one links to its full record on Wordfence.
| Vulnerability | Severity | Affected versions | Fixed in |
|---|---|---|---|
| Missing AuthorizationCVE-2026-120847 · 7 November 2026 | Medium 4.3 | 4.3.3 and earlier | 4.3.4 |
| Missing AuthorizationCVE-2026-114180 · 22 October 2026 | Medium 5.3 | 4.3.2 and earlier | 4.3.3 |
| MetForm 2.2.1 - 4.3.0 - Unauthenticated Information ExposureCVE-2026-86834 · 1 October 2026 | Medium 5.3 | 2.2.1 to 4.3.0 | 4.3.1 |
| Unauthenticated Arbitrary HTML Injection in Notification EmailsCVE-2026-86833 · 1 October 2026 | Medium 4.7 | 4.3.0 and earlier | 4.3.1 |
| Authenticated (Contributor+) Stored Cross-Site ScriptingCVE-2026-103339 · 1 October 2026 | Medium 6.4 | 4.3.0 and earlier | 4.3.1 |
| Unauthenticated Information ExposureCVE-2026-86832 · 1 October 2026 | Medium 5.3 | 4.3.0 and earlier | 4.3.1 |
| Unauthenticated Email Header InjectionCVE-2026-86813 · 9 September 2026 | Medium 5.3 | before 4.1.9 | 4.1.9 |
| Authenticated (Contributor+) Stored Cross-Site Scripting via 'mf_form_id' Widget SettingCVE-2026-18100 · 24 August 2026 | Medium 6.4 | 4.1.8 and earlier | 4.1.9 |
| Unauthenticated Form Submission Exposure via Forgeable Cookie ValueCVE-2026-0633 · 23 January 2026 | Low 3.7 | 4.1.0 and earlier | 4.1.1 |
| Authenticated(Contributor+) Stored Cross-Site Scripting via `mf-template` DOM ElementCVE-2025-5684 · 29 July 2025 | Medium 6.4 | 4.0.1 and earlier | 4.0.2 |
| Authenticated (Admin+) Server-Side Request ForgeryCVE-2025-30914 · 27 March 2025 | Medium 5.5 | 3.9.2 and earlier | 3.9.3 |
| Unauthenticated Double-Extension Arbitrary File UploadCVE-2023-0714 · 16 August 2024 | High 8.1 | 3.2.4 and earlier | 3.3.0 |
| Unauthenticated Sensitive Information ExposureCVE-2024-4266 · 10 June 2024 | Medium 5.3 | 3.8.8 and earlier | 3.8.9 |
| Authenticated (Contributor+) Stored Cross-Site Scripting via WidgetsCVE-2024-2791 · 1 April 2024 | Medium 6.4 | 3.8.5 and earlier | 3.8.6 |
| Authenticated(Contributor+) Stored Cross-Site Scripting via ShortcodeCVE-2024-1585 · 7 March 2024 | Medium 6.4 | 3.8.3 and earlier | 3.8.4 |
| Cross-Site Request ForgeryCVE-2023-6788 · 8 January 2024 | Medium 5.4 | 3.8.1 and earlier | 3.8.2 |
| Missing Authorization via submitCVE-2023-50903 · 26 December 2023 | Medium 5.3 | 3.4.0 and earlier | 3.4.1 |
| Authenticated (Subscriber+) Information Disclosure via 'mf_first_name' shortcodeCVE-2023-0689 · 30 August 2023 | Medium 4.3 | 3.3.1 and earlier | 3.3.2 |
| Cross-Site Request Forgery via permalink_setupCVE-2023-2517 · 22 June 2023 | Medium 5.4 | 3.3.2 and earlier | 3.3.3 |
| Authenticated (Subscriber+) Information Disclosure via mf shortcodeCVE-2023-0694 · 8 June 2023 | Medium 6.5 | 3.3.1 and earlier | 3.3.2 |
| Authenticated (Contributor+) Stored Cross-Site Scripting via mf shortcodeCVE-2023-0695 · 8 June 2023 | Medium 5.4 | 3.3.0 and earlier | 3.3.1 |
| Authenticated (Subscriber+) Information Disclosure via 'mf_transaction_id' shortcodeCVE-2023-0693 · 8 June 2023 | Medium 6.5 | 3.3.1 and earlier | 3.3.2 |
| Authenticated (Contributor+) Stored Cross-Site Scripting via mf_last_name shortcodeCVE-2023-0709 · 8 June 2023 | Medium 5.4 | 3.3.0 and earlier | 3.3.1 |
| Authenticated (Subscriber+) Information Disclosure via mf_thankyou shortcodeCVE-2023-0688 · 8 June 2023 | Medium 6.5 | 3.3.1 and earlier | 3.3.2 |
| Authenticated (Contributor+) Stored Cross-Site Scripting via mf_thankyou shortcodeCVE-2023-0710 · 8 June 2023 | Medium 4.9 | 3.3.0 and earlier | 3.3.1 |
| Authenticated (Subscriber+) Information Disclosure via mf_last_name shortcodeCVE-2023-0691 · 8 June 2023 | Medium 4.3 | 3.3.1 and earlier | 3.3.2 |
| Authenticated (Contributor+) Stored Cross-Site Scripting via mf_first_name shortcodeCVE-2023-0708 · 8 June 2023 | Medium 5.4 | 3.3.0 and earlier | 3.3.1 |
| Unauthenticated CSV InjectionCVE-2023-0721 · 8 June 2023 | High 8.3 | 3.3.0 and earlier | 3.3.1 |
| Authenticated (Subscriber+) Information Disclosure via 'mf_payment_status' shortcodeCVE-2023-0692 · 8 June 2023 | Medium 4.3 | 3.3.1 and earlier | 3.3.2 |
| Missing AuthorizationCVE-2023-1843 · 4 May 2023 | Medium 6.5 | 3.3.0 and earlier | 3.3.2 |
| ReCaptcha Protection BypassCVE-2023-0085 · 2 March 2023 | Medium 5.3 | 3.2.1 and earlier | 3.2.2 |
| Unauthenticated Stored Cross-Site ScriptingCVE-2023-0084 · 2 February 2023 | High 7.2 | 3.1.2 and earlier | 3.2.0 |
| Sensitive Information DisclosureCVE-2022-1442 · 23 April 2022 | High 7.5 | 2.1.3 and earlier | 2.1.4 |
If you run MetForm
What to do now
- Check your version. In WordPress, go to Plugins and look under MetForm. Compare it with the affected versions above.
- Update to 4.3.4 or later. Take a backup first, then update. If the update breaks something, you can restore the backup while you work out why.
- Check the rest of your site. One outdated plugin is rarely the only one. Our free security check looks at your WordPress version, and the plugins and theme it can see from the outside, for known flaws and emails you a report.
Pressfort keeps your plugins up to date for you, testing each update on a copy of your site first, and its virtual patching blocks attacks on newly disclosed flaws, often before a fix is out. If your site does get hacked, two clean-ups a year are included, with a developer stepping in when needed. See how it works.
Forms
Related plugins
Gravity Forms
A paid form builder that's popular with agencies and businesses.
30 known19 in the last year
Contact Form 7
One of the oldest and most widely used contact form plugins for WordPress.
10 known2 in the last year
WPForms Lite
The free version of WPForms, a drag-and-drop form builder.
28 known14 in the last year
Fluent Forms
A drag-and-drop form builder for contact forms, surveys and payments.
47 known24 in the last year
CFDB7
Saves Contact Form 7 submissions in the WordPress database.
8 known1 in the last year
Forminator
A free form, quiz and poll builder from WPMU DEV.
82 known48 in the last year
Data sources and licences
Vulnerability data comes from Wordfence Intelligence and is refreshed daily. Severity is the CVSS score given in each record. Pressfort is not affiliated with Wordfence or Defiant Inc.
Copyright 2012-2026 Defiant Inc.
Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy.
https://www.wordfence.com/wordfence-intelligence-terms-and-conditions/
Copyright 1999-2026 The MITRE Corporation
CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.
Not sure yet?
Find out how exposed your site is.
Send us your site address and get a free, plain-English report of what we find. We check from the outside, so there are no logins to hand over and nothing to install.
- Known vulnerability in 1 pluginGallery plugin, file upload flawUrgent
- WordPress is out of dateRunning 6.7.1, latest is 6.8.3To fix
- 6 plugins and 1 theme out of dateOldest is 14 months behindTo fix