Input validation vulnerability in Metform Elementor Contact Form Builder – Flexible and Design-Friendly Contact Form builder plugin for WordPress 3.3.0

The Metform Elementor Contact Form Builder for WordPress is a plugin that helps create contact forms for websites. Unfortunately, there is a vulnerability in versions up to, and including, 3.3.0 that allows attackers to inject malicious scripts into webpages. This can be done by using the ‘mf_first_name’ shortcode which echoes unescaped form submissions. The attacker must have contributor-level permissions or above to do this. For the malicious script to execute, the victim must visit a crafted link with the form entry id – the script itself is stored in the site database.