The MetForm plugin for WordPress contains a stored cross‑site scripting flaw within the ’mf_form_id’ widget setting. Unsanitized input from contributors or higher roles is saved, allowing attackers to inject arbitrary scripts that execute whenever a page containing the injected form is viewed. The vulnerability is a classic XSS bug (CWE‑79) and can lead to session hijacking, credential theft, or defacement on victim browsers. Because the payload bypasses the usual Elementor filtering, the script is stored and later rendered without proper escaping.

Affected are all installations of the MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor plugin for WordPress from any version up to and including 4.1.8. WordPress sites that allow users with contributor‑level or higher access to edit or create MetForm widgets are at risk. The vulnerability exists in the plugin’s code located in form-picker-utils.php, util.php, and form.php in the stated releases.

The CVSS score is 6.4, indicating moderate severity, and the vulnerability is not yet listed in the CISA KEV catalog. EPSS data is unavailable, so the likelihood of exploitation cannot be quantified, but the requirement for authenticated contributor access lowers the attack surface. An attacker with such credentials can inject the payload directly through the WordPress admin interface, and the script will execute for any user who loads the affected page, potentially compromising on‑site sessions.