CVE-2026-18100: MetForm <= 4.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'mf_form_id' Widget Setting
The MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'mfformid' Widget Setting in all versions up to, and including, 4.1.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload bypasses Elementor's save-time wpksespost filter because it contains no HTML tags, and MetForm's own strreplace transformation of script tags into JavaScript template literal expressions provides an additional delivery path.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor (WordPress plugin)to a version that resolves this vulnerability.Fixed in 4.1.8 - Compensating control
Restrict authenticated contributor-level (and above) users’ ability to create/edit pages that include MetForm widgets until the plugin is patched.
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated WordPress user with Contributor-level access or higher can exploit it. The attacker must be able to configure the affected MetForm widget setting on a page.
What is required for the malicious script to run?
A user must access a page containing the attacker-injected widget configuration. No additional user interaction is described beyond visiting the injected page.
Are default protections sufficient to prevent exploitation?
No. The payload can bypass Elementor's save-time wp_kses_post filter because it contains no HTML tags, and MetForm's script-tag transformation provides an additional delivery path.
Which installations are affected?
All MetForm versions up to and including 4.1.8 are affected, based on the provided information.