Input validation vulnerability in Metform Elementor Contact Form Builder – Flexible and Design-Friendly Contact Form builder plugin for WordPress 3.3.0

The Metform Elementor Contact Form Builder for WordPress is a plugin that is vulnerable to a type of attack called Cross-Site Scripting. In versions up to and including 3.3.0, this vulnerability can be exploited by using the ‘mf’ shortcode to echo unescaped form submissions. This means that anyone with contributor-level permissions or above can inject malicious web scripts into pages. When the victim visits the specific page containing the malicious code, the script will execute. Though the script is stored in the site database, the victim must still visit a crafted link with the form entry id in order for the script to be executed.