CVE-2023-0710

The Metform plugin for Elementor versions up to 3.3.0 contains a stored cross-site scripting vulnerability in the mf_thankyou shortcode where the fname attribute fails to properly sanitize user input before displaying form submissions. Authenticated users with contributor access or higher can inject malicious scripts that execute when visitors access a page containing the shortcode with a specific submission ID in the URL, though execution requires both a successful payment transaction and the victim clicking a specially crafted link. The malicious code is persisted in the database, making this a stored XSS rather than a temporary attack.

Based on public CVE data (MITRE/NVD).