CVE-2026-86833
MetForm < 4.3.1 - Unauthenticated HTML Injection in Notification Emails via Field Shortcodes
- State
- Published
- Severity
- 5.4 Medium
- Published
- Oct 7, 2026
- Updated
- Oct 7, 2026
- Reserved
- Sep 8, 2026
Description
The MetForm WordPress plugin before 4.3.1 does not sanitize or escape submitted form-field values before inserting them into the HTML body of its email notifications, allowing unauthenticated attackers to inject arbitrary markup into the administrator and submitter notification emails the site sends.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 5.4 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N | WPScan |
Weaknesses
- CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Affected Products
| Product | Versions |
|---|---|
MetFormUnknown |
|
References
- https://wpscan.com/vulnerability/6d6850d6-6fdf-4b97-9ccb-c90f9ed01ab0/exploitvdb-entrytechnical-description
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.