Input validation vulnerability in Metform Elementor Contact Form Builder – Flexible and Design-Friendly Contact Form builder plugin for WordPress 3.3.0

The Metform Elementor Contact Form Builder for WordPress contains a security issue that can allow attackers to inject malicious code into WordPress pages. This issue affects versions up to and including 3.3.0. Attackers with contributor-level permissions or higher could use the ‘mf_last_name’ shortcode to echo user-submitted information without it being properly escaped. This means that when a user visits a page with the shortcode and the correct form entry ID, the malicious code would execute. Although a user must visit the crafted link for the malicious code to execute, the code itself is stored in the WordPress database.