Input validation vulnerability in Metform Elementor Contact Form Builder – Flexible and Design-Friendly Contact Form builder plugin for WordPress 3.3.0

The Metform Elementor Contact Form Builder for WordPress had a security flaw in versions up to and including 3.3.0. Attackers with contributor-level permissions or higher could use the ‘fname’ attribute of the ‘mf_thankyou’ shortcode to inject malicious web scripts into pages. This means a crafted link with the form entry id had to be visited by the victim for the script to execute. This was possible because the script was stored in the site database, although the complexity was increased as successful payment was required.