Advisories · Technology
roxnor MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor.
Every CVE that names roxnor MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 3.7 Low
MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor <= 4.1.0 - Unauthenticated Form Submission Exposure via Forgeable Cookie Value
- roxnor MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor
- Authentication bypass
- CVSS 6.4 Medium
MetForm <= 4.0.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via `mf-template` DOM Element
- roxnor MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor
- Cross-site scripting (XSS)
- CVSS 8.1 High
Metform Elementor Contact Form Builder <= 3.2.4 - Unauthenticated Double-Extension Arbitrary File Upload
- roxnor MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor
- Unrestricted file upload
- CVSS 5.3 Medium
MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor <= 3.8.8 - Unauthenticated Sensitive Information Exposure
- roxnor MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor
- Information disclosure
- CVSS 6.4 Medium
Metform Elementor Contact Form Builder <= 3.8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widgets
- roxnor MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Metform Elementor Contact Form Builder <= 3.8.3 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode
- roxnor MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
Metform Elementor Contact Form Builder <= 3.8.1 - Cross-Site Request Forgery
- roxnor MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor
- Cross-site request forgery (CSRF)
- CVSS 4.3 Medium
Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via 'mf_first_name' shortcode
- roxnor MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor
- Broken access control
- CVSS 5.4 Medium
Metform Elementor Contact Form Builder <= 3.3.2 - Cross-Site Request Forgery via permalink_setup
- roxnor MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor
- Cross-site request forgery (CSRF)
- CVSS 4.3 Medium
Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via 'mf_payment_status' shortcode
- roxnor MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor
- Broken access control
- CVSS 8.3 High
Metform Elementor Contact Form Builder <= 3.3.0 - Unauthenticated CSV Injection
- roxnor MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor
- Other injection
- CVSS 5.4 Medium
Metform Elementor Contact Form Builder <= 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via mf_first_name shortcode
- roxnor MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor
- Cross-site scripting (XSS)
- CVSS 4.3 Medium
Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via mf_last_name shortcode
- roxnor MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor
- Broken access control
- CVSS 4.9 Medium
Metform Elementor Contact Form Builder <= 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via mf_thankyou shortcode
- roxnor MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via mf_thankyou shortcode
- roxnor MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor
- Broken access control
- CVSS 6.5 Medium
Metform Elementor Contact Form Builder <= 3.3.0 - Missing Authorization
- roxnor MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor
- Broken access control
- CVSS 5.4 Medium
Metform Elementor Contact Form Builder <= 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via mf_last_name shortcode
- roxnor MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via 'mf_transaction_id' shortcode
- roxnor MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor
- Broken access control
- CVSS 5.4 Medium
Metform Elementor Contact Form Builder <= 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via mf shortcode
- roxnor MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via mf shortcode
- roxnor MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor
- Broken access control
- CVSS 7.2 HighCritical · CVSS 7+ and EPSS
Metform Elementor Contact Form Builder <= 3.1.2 - Unauthenticated Stored Cross-Site Scripting
- roxnor MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
Metform Elementor Contact Form Builder <= 3.2.1 - reCaptcha Protection Bypass
- roxnor MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor
- CWE-693
- CVSS 7.5 High
Metform Elementor Contact Form Builder <= 2.1.3 - Sensitive Information Disclosure
- roxnor MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor
- Broken access control