wpmet Vulnerabilities and Affected Products
Vulnerabilities associated with MetForm Pro.
Products
Clear product- ElementsKit Pro8 vulnerabilities
- Wp Ultimate Review6 vulnerabilities
- elements_kit_elementor_addons5 vulnerabilities
- MetForm Pro4 vulnerabilities
- ElementsKit Elementor addons Lite2 vulnerabilities
- metform_elementor_contact_form_builder2 vulnerabilities
- wp_fundraising_donation_and_crowdfunding_platform2 vulnerabilities
- wp_ultimate_review2 vulnerabilities
- Elements kit Elementor addons1 vulnerability
- Elements Kit Lite1 vulnerability
- Elements Kit Pro1 vulnerability
- ElementsKit Elementor addons1 vulnerability
- GetGenie1 vulnerability
- gutenkit1 vulnerability
- ShopEngine1 vulnerability
- WP Fundraising Donation and Crowdfunding Platform1 vulnerability
- Wp Social Login and Register Social Counter1 vulnerability
- wp_social_login_and_register_social_counter1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2026-24611CRITICAL | WordPress MetForm Pro plugin <= 3.9.1 - Broken Access Control vulnerabilityUnauthenticated Broken Access Control in MetForm Pro <= 3.9.1 versions. CWE-862Jun 17, 2026 | CVSS9.1v3.1 | EPSS0.437% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-24610MEDIUM | WordPress MetForm Pro plugin <= 3.9.1 - Broken Access Control vulnerabilitySubscriber Broken Access Control in MetForm Pro <= 3.9.1 versions. CWE-862Jun 17, 2026 | CVSS4.3v3.1 | EPSS0.243% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-1782MEDIUM | MetForm Pro <= 3.9.7 - Unauthenticated Payment Amount Manipulation via 'mf-calculation'The MetForm Pro plugin for WordPress is vulnerable to Improper Input Validation in all versions up to, and including, 3.9.7 This is due to the payment integrations (Stripe/PayPal) trusting a user-submitted calculation field value without recomputing or validating it against the configured form price. This makes it possible for unauthenticated attackers to manipulate the payment amount via the 'mf-calculation' field in the form submission REST request granted there exists a specific form with th… CWE-20Apr 15, 2026 | CVSS5.3v3.1 | EPSS0.266% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-1261HIGH | MetForm Pro <= 3.9.6 - Unauthenticated Stored Cross-Site ScriptingThe MetForm Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Quiz feature in all versions up to, and including, 3.9.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CWE-79Mar 10, 2026 | CVSS7.2v3.1 | EPSS0.308% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |