Input validation vulnerability in MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor 3.8.5

The Metform Elementor Contact Form Builder plugin for WordPress has a security issue that can allow attackers to insert harmful code into the plugin’s widgets. This can happen in all versions of the plugin up to 3.8.5 because the plugin does not properly clean up user-submitted information. This means that attackers who have at least contributor-level access can add dangerous code to a page, which will then run whenever a user visits that page.