CVE-2023-0084

HIGH

Metform Elementor Contact Form Builder <= 3.1.2 - Unauthenticated Stored Cross-Site Scripting

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2023-0084 has a selected CVSS score of 7.2 (high); EIP currently links 1 catalogued exploit.

Description

The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via text areas on forms in versions up to, and including, 3.1.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page, which is the submissions page.

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
1

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Jan 13, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor

Browse roxnor / MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor

Default status: unaffected

CVE ListThrough 3.1.2affected

Proofs of concept

1

Catalogued exploits

ExploitDBMetform Elementor Contact Form Builder v3.1.2 - Unauthenticated Stored Cross-Site Scripting (XSS)ExploitDB exploitby Mohammed ChemouriNot analyzed1 file
ExploitDB
PoC details

References

6