Metform
Monthly
Email HTML injection in the MetForm WordPress plugin before 4.3.1 lets unauthenticated attackers submit crafted form-field values that are inserted into the HTML body of administrator and submitter notification emails without sanitization or escaping, allowing arbitrary markup to be rendered in the recipient's mail client. Successful exploitation yields limited confidentiality and integrity impact (CVSS 3.1 base 5.4, AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) and is confined to email-rendered content - spoofing or phishing-style content rather than server-side execution - because the injected markup takes effect only when a recipient opens the notification. Publicly available exploit code exists (WPScan published the finding and a proof-of-concept reference), and no public exploit identified at time of analysis would be misleading here; there is no CISA KEV listing, so this is treated as a moderate-priority, non-actively-exploited issue.
Unauthenticated attackers can read sensitive HubSpot API response data - including correlation identifiers and cookies - from WordPress sites running the MetForm plugin before 4.3.1, because the plugin writes a debug file into the web root on every form submission whenever its HubSpot Forms integration is enabled and does not restrict access to that file. Exploitation requires the non-default HubSpot integration to be active, at least one prior form submission to populate the file, and discovery of the file's location, which is why the assessed vector is AV:N/AC:H/PR:N/UI:N with confidentiality-only impact and a low base score of 3.7. Publicly available exploit code exists, but there is no confirmed active exploitation, the SSVC assessment records exploitation as 'none' and automation as 'no', and EPSS is very low at 0.14% (3rd percentile).
Unauthenticated information disclosure in the MetForm WordPress plugin before 4.3.1 exposes stored form submission data through the plugin's REST API, allowing anyone who can reach the site's REST endpoints to read submitter information without logging in. Exploitation is trivial - the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N confirms network reachability, low complexity, no authentication and no user interaction - and publicly available exploit code exists, though there is no indication of confirmed active exploitation (not in CISA KEV) and EPSS is low at 0.14% (3rd percentile). Impact is confined to confidentiality: only data that submitters previously entered on forms installed before 4.3.1 can be read, with no integrity or availability effect, making this a genuine but moderate-severity issue rather than a critical priority.
Stored cross-site scripting in the Wpmet Metform WordPress plugin (versions through 4.3.0) lets a low-privilege authenticated user, such as a contributor, plant a malicious script inside form fields or plugin settings; the payload is then stored and executes in the browser of any higher-privileged user (typically an administrator or editor) who views the affected page. The base CVSS score is 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), and the practical risk is LOW-to-MEDIUM because exploitation is gated by two prerequisites: an authenticated account with at least contributor-level access and a victim who subsequently opens the page where the stored payload renders. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, so this is a latent persistence-and-privilege-abuse vector rather than an actively exploited campaign.
Email HTML injection in the MetForm WordPress plugin before 4.3.1 lets unauthenticated attackers submit crafted form-field values that are inserted into the HTML body of administrator and submitter notification emails without sanitization or escaping, allowing arbitrary markup to be rendered in the recipient's mail client. Successful exploitation yields limited confidentiality and integrity impact (CVSS 3.1 base 5.4, AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) and is confined to email-rendered content - spoofing or phishing-style content rather than server-side execution - because the injected markup takes effect only when a recipient opens the notification. Publicly available exploit code exists (WPScan published the finding and a proof-of-concept reference), and no public exploit identified at time of analysis would be misleading here; there is no CISA KEV listing, so this is treated as a moderate-priority, non-actively-exploited issue.
Unauthenticated attackers can read sensitive HubSpot API response data - including correlation identifiers and cookies - from WordPress sites running the MetForm plugin before 4.3.1, because the plugin writes a debug file into the web root on every form submission whenever its HubSpot Forms integration is enabled and does not restrict access to that file. Exploitation requires the non-default HubSpot integration to be active, at least one prior form submission to populate the file, and discovery of the file's location, which is why the assessed vector is AV:N/AC:H/PR:N/UI:N with confidentiality-only impact and a low base score of 3.7. Publicly available exploit code exists, but there is no confirmed active exploitation, the SSVC assessment records exploitation as 'none' and automation as 'no', and EPSS is very low at 0.14% (3rd percentile).
Unauthenticated information disclosure in the MetForm WordPress plugin before 4.3.1 exposes stored form submission data through the plugin's REST API, allowing anyone who can reach the site's REST endpoints to read submitter information without logging in. Exploitation is trivial - the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N confirms network reachability, low complexity, no authentication and no user interaction - and publicly available exploit code exists, though there is no indication of confirmed active exploitation (not in CISA KEV) and EPSS is low at 0.14% (3rd percentile). Impact is confined to confidentiality: only data that submitters previously entered on forms installed before 4.3.1 can be read, with no integrity or availability effect, making this a genuine but moderate-severity issue rather than a critical priority.
Stored cross-site scripting in the Wpmet Metform WordPress plugin (versions through 4.3.0) lets a low-privilege authenticated user, such as a contributor, plant a malicious script inside form fields or plugin settings; the payload is then stored and executes in the browser of any higher-privileged user (typically an administrator or editor) who views the affected page. The base CVSS score is 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), and the practical risk is LOW-to-MEDIUM because exploitation is gated by two prerequisites: an authenticated account with at least contributor-level access and a victim who subsequently opens the page where the stored payload renders. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, so this is a latent persistence-and-privilege-abuse vector rather than an actively exploited campaign.