PLUGIN SECURITY
Is MetForm safe?
Elementor forms builder to create WordPress forms like contact form, booking form, feedback form, survey form, application form & 40+ form templates.
What this plugin does
- Slug:
metform - Author: Roxnor
- 600000+ active installs
- 94/100 rating (504 reviews on wordpress.org)
- 9989948 all-time downloads
- On WordPress.org since 2019-08-29
contact form buildercustom formelementor formform builderMulti-Step Form
Maintenance status
- Latest known version: 4.1.9
- Last updated: 2026-08-30 10:30am GMT
- Tested up to WordPress: 7.1
- Requires PHP: 7.4+
- Max supported PHP (analyzed): 8.4
Known vulnerabilities
27 known CVEs on file for MetForm.
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2026-18100 | MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor [metform] < 4.1.9 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.4 | < 4.1.9 | 4.1.9 | 2026-01-23 | ✓ fixed in latest |
| CVE-2025-30914 | MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor [metform] < 3.9.3 | Server-Side Request Forgery (SSRF) | Medium 4.4 | < 3.9.3 | 3.9.3 | 2025-03-27 | ✓ fixed in latest |
| CVE-2023-0714 | MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor [metform] < 3.3.0 | Unrestricted Upload of File with Dangerous Type | Critical 9.8 | < 3.3.0 | 3.3.0 | 2024-08-16 | ✓ fixed in latest |
| CVE-2024-4266 | MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor [metform] < 3.8.9 | Exposure of Sensitive Information to an Unauthorized Actor | High 7.5 | < 3.8.9 | 3.8.9 | 2024-06-10 | ✓ fixed in latest |
| CVE-2024-33570 | MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor [metform] < 3.8.4 | Missing Authorization | Medium 4.3 | < 3.8.4 | 3.8.4 | 2024-04-25 | ✓ fixed in latest |
| CVE-2024-2791 | MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor [metform] < 3.8.6 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 3.8.6 | 3.8.6 | 2024-04-01 | ✓ fixed in latest |
| CVE-2024-1585 | MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor [metform] < 3.8.4 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 3.8.4 | 3.8.4 | 2024-03-07 | ✓ fixed in latest |
| CVE-2023-6788 | MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor [metform] < 3.8.2 | Cross-Site Request Forgery (CSRF) | Medium 5.4 | < 3.8.2 | 3.8.2 | 2024-01-08 | ✓ fixed in latest |
+ 21 more known vulnerabilities
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2023-50903 | MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor [metform] < 3.4.1 | Missing Authorization | Medium 5.3 | < 3.4.1 | 3.4.1 | 2023-12-26 | ✓ fixed in latest |
| CVE-2023-0689 | MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor [metform] < 3.3.2 | Authorization Bypass Through User-Controlled Key | Medium 4.3 | < 3.3.2 | 3.3.2 | 2023-08-30 | ✓ fixed in latest |
| CVE-2023-2517 | MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor [metform] < 3.3.3 | Cross-Site Request Forgery (CSRF) | Medium 4.3 | < 3.3.3 | 3.3.3 | 2023-06-22 | ✓ fixed in latest |
| CVE-2023-0691 | MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor [metform] < 3.3.2 | Authorization Bypass Through User-Controlled Key | Medium 4.3 | < 3.3.2 | 3.3.2 | 2023-06-08 | ✓ fixed in latest |
| CVE-2023-0693 | MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor [metform] < 3.3.2 | Authorization Bypass Through User-Controlled Key | Medium 4.3 | < 3.3.2 | 3.3.2 | 2023-06-08 | ✓ fixed in latest |
| CVE-2023-0694 | MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor [metform] < 3.3.2 | Authorization Bypass Through User-Controlled Key | Medium 4.3 | < 3.3.2 | 3.3.2 | 2023-06-08 | ✓ fixed in latest |
| CVE-2023-0688, CVE-2023-0691, CVE-2023-0692, CVE-2023-0693, CVE-2023-0694 | MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor [metform] < 3.3.2 | Authorization Bypass Through User-Controlled Key | Medium 6.5 | < 3.3.2 | 3.3.2 | 2023-06-08 | ✓ fixed in latest |
| CVE-2023-0710 | MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor [metform] < 3.3.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 3.3.1 | 3.3.1 | 2023-06-08 | ✓ fixed in latest |
| CVE-2023-0709 | MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor [metform] < 3.3.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 3.3.1 | 3.3.1 | 2023-06-08 | ✓ fixed in latest |
| CVE-2023-0692 | MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor [metform] < 3.3.2 | Authorization Bypass Through User-Controlled Key | Medium 4.3 | < 3.3.2 | 3.3.2 | 2023-06-08 | ✓ fixed in latest |
| CVE-2023-0721 | MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor [metform] < 3.3.1 | Improper Neutralization of Formula Elements in a CSV File | High 7.8 | < 3.3.1 | 3.3.1 | 2023-06-08 | ✓ fixed in latest |
| CVE-2023-0708 | MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor [metform] < 3.3.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 3.3.1 | 3.3.1 | 2023-06-08 | ✓ fixed in latest |
| CVE-2023-0695, CVE-2023-0708, CVE-2023-0709, CVE-2023-0710 | MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor [metform] < 3.3.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 3.3.1 | 3.3.1 | 2023-06-08 | ✓ fixed in latest |
| CVE-2023-1843 | MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor [metform] < 3.3.1 | Missing Authorization | Medium 5.3 | < 3.3.2 | 3.3.2 | 2023-05-04 | ✓ fixed in latest |
| CVE-2023-0085 | MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor [metform] < 3.2.2 | Protection Mechanism Failure | Medium 5.3 | < 3.2.2 | 3.2.2 | 2023-03-02 | ✓ fixed in latest |
| CVE-2023-0084 | MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor [metform] < 3.2.0 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 3.2.0 | 3.2.0 | 2023-02-02 | ✓ fixed in latest |
| CVE-2022-1442 | MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor [metform] < 3.2.0 | Missing Authorization | High 7.5 | < 3.2.0 | 3.2.0 | 2022-04-23 | ✓ fixed in latest |
| — | MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor [metform] < 4.0.2 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.4 | < 4.0.2 | 4.0.2 | 0000-00-00 | ✓ fixed in latest |
| — | MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor [metform] < 4.1.1 | — | Low 3.7 | < 4.1.1 | 4.1.1 | 0000-00-00 | ✓ fixed in latest |
| CVE-2025-5684 | MetForm < 4.0.2 - Contributor+ Stored XSS via mf-template DOM Element | — | Unknown | < 4.0.2 | 4.0.2 | — | ✓ fixed in latest |
| CVE-2026-0633 | MetForm < 4.1.1 - Unauthenticated Form Submission Exposure via Forgeable Cookie Value | — | Unknown | < 4.1.1 | 4.1.1 | — | ✓ fixed in latest |
How to fix it
Keep MetForm updated — 4.1.9 is the latest version on wordpress.org, and each CVE above lists the exact release that fixed it ("Fixed in").
This is the plugin's full known vulnerability history, not a scan of any specific installation — run a free scan of your own site to check your exact installed version.
Safer / more established alternatives
- WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More — 5000000+ active installs — 96/100 (14369)
- Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder — 700000+ active installs — 96/100 (791)
- Forminator Forms – Contact Form, Payment Form & Custom Form Builder — 600000+ active installs — 96/100 (2118)
- Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More — 300000+ active installs — 96/100 (1380)
- FormLayer — 100000+ active installs — max PHP 8.4
Check your own WordPress site
Run a free passive scan now, or create a free account and install the WP Clinic plugin for a deep scan of your whole hosting account and AI-assisted repair.