What’s Vulnerable › Products

roxnor MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor vulnerabilities

26 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 4 published in the last 12 months.

Check whether your roxnor MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor version is affected

Latest roxnor MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor vulnerabilities

• CVE-2026-0633 — MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor <= 4.1.0 - Unauthenticated Form Submission Exposure via Forgeable Cookie Value (CVSS 3.7)
• CVE-2025-5684 — MetForm <= 4.0.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via `mf-template` DOM Element (CVSS 6.4)
• CVE-2025-30914 — WordPress Metform Elementor Contact Form Builder plugin <= 3.9.7 - Server Side Request Forgery (SSRF) vulnerability (CVSS 4.4)
• CVE-2023-50903 — WordPress Metform Elementor Contact Form Builder plugin <= 3.4.0 - Broken Access Control vulnerability (CVSS 9.8)
• CVE-2023-0714 — Metform Elementor Contact Form Builder <= 3.2.4 - Unauthenticated Double-Extension Arbitrary File Upload (CVSS 9.8)
• CVE-2024-4266 — MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor <= 3.8.8 - Unauthenticated Sensitive Information Exposure (CVSS 7.5)
• CVE-2024-33570 — WordPress MetForm plugin <= 3.8.3 - Broken Access Control vulnerability (CVSS 8.8)
• CVE-2024-2791 — Metform Elementor Contact Form Builder <= 3.8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widgets (CVSS 5.4)
• CVE-2024-1585 — Metform Elementor Contact Form Builder <= 3.8.3 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 5.4)
• CVE-2023-6788 — Metform Elementor Contact Form Builder <= 3.8.1 - Cross-Site Request Forgery (CVSS 5.4)
• CVE-2023-0689 — Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via 'mf_first_name' shortcode (CVSS 4.3)
• CVE-2023-2517 — Metform Elementor Contact Form Builder <= 3.3.2 - Cross-Site Request Forgery via permalink_setup (CVSS 4.3)
• CVE-2023-1843 — Metform Elementor Contact Form Builder <= 3.3.0 - Missing Authorization (CVSS 5.3)
• CVE-2023-0721 — Metform Elementor Contact Form Builder <= 3.3.0 - Unauthenticated CSV Injection (CVSS 7.8)
• CVE-2023-0710 — Metform Elementor Contact Form Builder <= 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via mf_thankyou shortcode (CVSS 5.4)
• CVE-2023-0709 — Metform Elementor Contact Form Builder <= 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via mf_last_name shortcode (CVSS 5.4)
• CVE-2023-0708 — Metform Elementor Contact Form Builder <= 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via mf_first_name shortcode (CVSS 5.4)
• CVE-2023-0695 — Metform Elementor Contact Form Builder <= 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via mf shortcode (CVSS 5.4)
• CVE-2023-0694 — Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via mf shortcode (CVSS 4.3)
• CVE-2023-0693 — Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via 'mf_transaction_id' shortcode (CVSS 4.3)
• CVE-2023-0692 — Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via 'mf_payment_status' shortcode (CVSS 4.3)
• CVE-2023-0691 — Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via mf_last_name shortcode (CVSS 4.3)
• CVE-2023-0688 — Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via mf_thankyou shortcode (CVSS 6.5)
• CVE-2023-0084 — Metform Elementor Contact Form Builder <= 3.1.2 - Unauthenticated Stored Cross-Site Scripting (CVSS 6.1)
• CVE-2023-0085 — Metform Elementor Contact Form Builder <= 3.2.1 - reCaptcha Protection Bypass (CVSS 5.3)