CVE-2025-5684: MetForm <= 4.0.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via `mf-template` DOM Element
The MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the mf-template DOM Element in all versions up to, and including, 4.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-5684?
CVE-2025-5684 is classified as a medium severity vulnerability due to the risk of stored cross-site scripting.
How do I fix CVE-2025-5684?
To fix CVE-2025-5684, upgrade the MetForm plugin to version 4.0.2 or later, where the vulnerability has been addressed.
What versions of MetForm are affected by CVE-2025-5684?
All versions of the MetForm plugin up to and including 4.0.1 are affected by CVE-2025-5684.
What type of vulnerability is CVE-2025-5684?
CVE-2025-5684 is a stored cross-site scripting vulnerability.
Is user data at risk due to CVE-2025-5684?
Yes, CVE-2025-5684 can potentially allow attackers to execute scripts in the context of user sessions, risking user data.