Medium
CVE-2026-103339
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 36
Reset filters
Medium
CVE-2026-86832
MetForm <= 4.3.0 - Unauthenticated Information Exposure
Medium
CVE-2026-86833
MetForm <= 4.3.0 - Unauthenticated Arbitrary HTML Injection in Notification Emails
Medium
CVE-2026-86834
MetForm 2.2.1 - 4.3.0 - Unauthenticated Information Exposure
Medium
CVE-2026-86813
MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor < 4.1.9 - Unauthenticated Email Header Injection
Medium
CVE-2026-18100
MetForm <= 4.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'mf_form_id' Widget Setting
Medium
CVE-2026-1782
MetForm Pro <= 3.9.7 - Unauthenticated Payment Amount Manipulation via 'mf-calculation'
Medium
CVE-2026-24611
MetForm Pro <= 3.9.8 - Missing Authorization
High
CVE-2026-1261
MetForm Pro <= 3.9.6 - Unauthenticated Stored Cross-Site Scripting
Low
CVE-2026-0633
MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor <= 4.1.0 - Unauthenticated Form Submission Exposure via Forgeable Cookie Value
Medium
CVE-2026-24610
MetForm Pro <= 3.9.8 - Missing Authorization
Medium
CVE-2025-14059
EmailKit <= 1.6.1 - Authenticated (Author+) Arbitrary File Read via Path Traversal
Medium
CVE-2025-5684
MetForm <= 4.0.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via `mf-template` DOM Element
Medium
CVE-2025-30914
Metform <= 3.9.2 - Authenticated (Admin+) Server-Side Request Forgery
High
CVE-2023-0714
Metform Elementor Contact Form Builder <= 3.2.4 - Unauthenticated Double-Extension Arbitrary File Upload
Medium
CVE-2024-4266
MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor <= 3.8.8 - Unauthenticated Sensitive Information Exposure
Medium
CVE-2024-2791
Metform Elementor Contact Form Builder <= 3.8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widgets
Medium
CVE-2024-1585
Metform Elementor Contact Form Builder <= 3.8.3 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode
Medium
CVE-2023-6788
Metform Elementor Contact Form Builder <= 3.8.1 - Cross-Site Request Forgery
Medium
CVE-2023-50903
Metform Elementor Contact Form Builder <= 3.4.0 - Missing Authorization via submit
Medium
CVE-2023-0689
Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via 'mf_first_name' shortcode
Medium
CVE-2023-2517
Metform Elementor Contact Form Builder <= 3.3.2 - Cross-Site Request Forgery via permalink_setup
Medium
CVE-2023-0692
Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via 'mf_payment_status' shortcode
High
CVE-2023-0721
Metform Elementor Contact Form Builder <= 3.3.0 - Unauthenticated CSV Injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.