CVE-2026-18100: MetForm <= 4.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'mf_form_id' Widget Setting

Published Aug 25, 2026
·
Updated

The MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'mfformid' Widget Setting in all versions up to, and including, 4.1.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload bypasses Elementor's save-time wpksespost filter because it contains no HTML tags, and MetForm's own strreplace transformation of script tags into JavaScript template literal expressions provides an additional delivery path.

Affected Software

1 affected component
WordPress plugin MetForm<=4.1.8

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor (WordPress plugin) to a version that resolves this vulnerability.

    Fixed in 4.1.8
  2. Compensating control

    Restrict authenticated contributor-level (and above) users’ ability to create/edit pages that include MetForm widgets until the plugin is patched.

Event History

Aug 25, 2026
CVE Published
via MITRE·07:39 AM
Data Sourced
via MITRE·07:39 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·08:18 AM
DescriptionSeverityWeakness

Frequently Asked Questions

1

Who can exploit this issue?

An authenticated WordPress user with Contributor-level access or higher can exploit it. The attacker must be able to configure the affected MetForm widget setting on a page.

2

What is required for the malicious script to run?

A user must access a page containing the attacker-injected widget configuration. No additional user interaction is described beyond visiting the injected page.

3

Are default protections sufficient to prevent exploitation?

No. The payload can bypass Elementor's save-time wp_kses_post filter because it contains no HTML tags, and MetForm's script-tag transformation provides an additional delivery path.

4

Which installations are affected?

All MetForm versions up to and including 4.1.8 are affected, based on the provided information.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203