EUVD-2026-94193
GHSA-fv77-662p-ggvf
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Unauthenticated remote form submission (AV:N/PR:N/AC:L) but impact requires a recipient to open the email (UI:R); HTML injection yields limited confidentiality/integrity impact and no availability loss.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
3DescriptionCVE.org
The MetForm WordPress plugin before 4.3.1 does not sanitize or escape submitted form-field values before inserting them into the HTML body of its email notifications, allowing unauthenticated attackers to inject arbitrary markup into the administrator and submitter notification emails the site sends.
AnalysisAI
Email HTML injection in the MetForm WordPress plugin before 4.3.1 lets unauthenticated attackers submit crafted form-field values that are inserted into the HTML body of administrator and submitter notification emails without sanitization or escaping, allowing arbitrary markup to be rendered in the recipient's mail client. Successful exploitation yields limited confidentiality and integrity impact (CVSS 3.1 base 5.4, AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) and is confined to email-rendered content - spoofing or phishing-style content rather than server-side execution - because the injected markup takes effect only when a recipient opens the notification. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target site uses MetForm (before 4.3.1) with at least one form configured to send admin and/or submitter email notifications in HTML format - the default notification feature is the exact attack surface. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but moderate-priority issue, not a critical one. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: MetForm 4.3.1 - upgrading the plugin to 4.3.1 or later is the primary and definitive fix, since the release adds the missing sanitization/escaping of submitted field values before they are placed into the notification email HTML body. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated information disclosure in the MetForm WordPress plugin before 4.3.1 exposes stored form submission data
Unauthenticated attackers can read sensitive HubSpot API response data - including correlation identifiers and cookies -
Stored cross-site scripting in the Wpmet Metform WordPress plugin (versions through 4.3.0) lets a low-privilege authenti
Same technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today