CVE-2026-86833: MetForm < 4.3.1 - Unauthenticated HTML Injection in Notification Emails via Field Shortcodes
The MetForm WordPress plugin before 4.3.1 does not sanitize or escape submitted form-field values before inserting them into the HTML body of its email notifications, allowing unauthenticated attackers to inject arbitrary markup into the administrator and submitter notification emails the site sends.
Affected Software
Event History
Frequently Asked Questions
Which sites are exposed to this issue?
Sites using MetForm versions earlier than 4.3.1 are affected when they send email notifications containing submitted form-field values. Both administrator and submitter notification emails can contain injected markup.
What does an attacker need to exploit it?
An attacker does not need to authenticate, but must be able to submit a MetForm form. Exploitation relies on supplying markup in form-field values that are inserted into notification email HTML.
How can I determine whether my site is affected?
Check the installed MetForm plugin version. Versions before 4.3.1 are affected.