Roxnor MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor

• CVE-2026-0633 Low 3.7 MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor <= 4.1.0 - Unauthenticated Form Submission Exposure via Forgeable Cookie Value 0.2%
• CVE-2025-5684 Medium 6.4 MetForm <= 4.0.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via `mf-template` DOM Element 0.2%
• CVE-2023-0714 High 8.1 Metform Elementor Contact Form Builder <= 3.2.4 - Unauthenticated Double-Extension Arbitrary File Upload 1.0%
• CVE-2024-4266 Medium 5.3 MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor <= 3.8.8 - Unauthenticated Sensitive Information Exposure 0.5%
• CVE-2024-2791 Medium 6.4 Metform Elementor Contact Form Builder <= 3.8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widgets 0.3%
• CVE-2024-1585 Medium 6.4 Metform Elementor Contact Form Builder <= 3.8.3 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode 0.5%
• CVE-2023-6788 Medium 5.4 Metform Elementor Contact Form Builder <= 3.8.1 - Cross-Site Request Forgery 0.2%
• CVE-2023-0689 Medium 4.3 Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via 'mf_first_name' shortcode 0.6%
• CVE-2023-2517 Medium 5.4 Metform Elementor Contact Form Builder <= 3.3.2 - Cross-Site Request Forgery via permalink_setup 0.4%
• CVE-2023-0692 Medium 4.3 Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via 'mf_payment_status' shortcode 0.6%
• CVE-2023-0721 High 8.3 Metform Elementor Contact Form Builder <= 3.3.0 - Unauthenticated CSV Injection 0.7%
• CVE-2023-0708 Medium 5.4 Metform Elementor Contact Form Builder <= 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via mf_first_name shortcode 0.6%
• CVE-2023-0691 Medium 4.3 Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via mf_last_name shortcode 0.6%
• CVE-2023-0710 Medium 4.9 Metform Elementor Contact Form Builder <= 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via mf_thankyou shortcode 0.4%
• CVE-2023-0688 Medium 6.5 Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via mf_thankyou shortcode 0.7%
• CVE-2023-1843 Medium 6.5 Metform Elementor Contact Form Builder <= 3.3.0 - Missing Authorization 0.6%
• CVE-2023-0709 Medium 5.4 Metform Elementor Contact Form Builder <= 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via mf_last_name shortcode 0.6%
• CVE-2023-0693 Medium 6.5 Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via 'mf_transaction_id' shortcode 0.7%
• CVE-2023-0695 Medium 5.4 Metform Elementor Contact Form Builder <= 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via mf shortcode 0.4%
• CVE-2023-0694 Medium 6.5 Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via mf shortcode 0.7%
• CVE-2023-0084 High 7.2 Metform Elementor Contact Form Builder <= 3.1.2 - Unauthenticated Stored Cross-Site Scripting 28.6%
• CVE-2023-0085 Medium 5.3 Metform Elementor Contact Form Builder <= 3.2.1 - reCaptcha Protection Bypass 0.7%
• CVE-2022-1442 High 7.5 Metform Elementor Contact Form Builder <= 2.1.3 - Sensitive Information Disclosure 8.8%