395 matches found
CVE-2026-86833
The MetForm WordPress plugin before 4.3.1 does not sanitize or escape submitted form-field values before inserting them into the HTML body of its email notifications, allowing unauthenticated attackers to inject arbitrary markup into the administrator and submitter notification emails the site...
CVE-2026-86833 MetForm < 4.3.1 - Unauthenticated HTML Injection in Notification Emails via Field Shortcodes
The MetForm WordPress plugin before 4.3.1 does not sanitize or escape submitted form-field values before inserting them into the HTML body of its email notifications, allowing unauthenticated attackers to inject arbitrary markup into the administrator and submitter notification emails the site...
EUVD-2026-94193
The MetForm WordPress plugin before 4.3.1 does not sanitize or escape submitted form-field values before inserting them into the HTML body of its email notifications, allowing unauthenticated attackers to inject arbitrary markup into the administrator and submitter notification emails the site...
CVE-2026-86833
The MetForm WordPress plugin versions prior to 4.3.1 is vulnerable to unauthenticated HTML injection . The root cause is a failure to sanitize or escape submitted form-field values before they are inserted into the HTML body of notification emails. This allows an unauthenticated attacker to injec...
WordPress Metform <=2.1.3 - Information Disclosure
WordPress Metform plugin through 2.1.3 is susceptible to information disclosure due to improper access control in the /core/forms/action.php file. An attacker can view all API keys and secrets of integrated third-party APIs such as that of PayPal, Stripe, Mailchimp, Hubspot, HelpScout, reCAPTCHA...
CVE-2022-1442
CVE-2022-1442 WordPress Plugin Metform = 2.1.3 - Control de Acceso Inadecuado que Permite la Divulgación No Autenticada de Información Sensible Descripción Es vulnerable a la divulgación de información sensible debido a un control de acceso inadecuado en el archivo /core/forms/action.php, que pue...
CVE-2026-86834
The MetForm WordPress plugin before 4.3.1 does not properly restrict access to a debug file it writes to the web root on every form submission when its HubSpot Forms integration is enabled, allowing unauthenticated attackers to read upstream API response data, including correlation identifiers an...
CVE-2026-86832
The MetForm WordPress plugin before 4.3.1 does not properly restrict access to form submission data, allowing unauthenticated attackers to view submitter information through the REST API...
EUVD-2026-91939
The MetForm WordPress plugin before 4.3.1 does not properly restrict access to form submission data, allowing unauthenticated attackers to view submitter information through the REST API...
CVE-2026-86832
The MetForm WordPress plugin, specifically versions before 4.3.1 , contains a vulnerability where it fails to properly restrict access to form submission data. This flaw allows unauthenticated attackers to view sensitive submitter information via the REST API . Exploitation details are not provid...
CVE-2026-86834 MetForm 2.2.1 - 4.3.0 - Unauthenticated Debug File Disclosure via HubSpot Forms Integration
The MetForm WordPress plugin before 4.3.1 does not properly restrict access to a debug file it writes to the web root on every form submission when its HubSpot Forms integration is enabled, allowing unauthenticated attackers to read upstream API response data, including correlation identifiers an...
CVE-2026-86832 MetForm < 4.3.1 - Unauthenticated Form Entry Data Disclosure via REST API
The MetForm WordPress plugin before 4.3.1 does not properly restrict access to form submission data, allowing unauthenticated attackers to view submitter information through the REST API...
CVE-2026-86834
The MetForm WordPress plugin (versions 2.2.1 through 4.3.0) contains a vulnerability where it fails to properly restrict access to a debug file written to the web root. This occurs during every form submission when the HubSpot Forms integration is enabled. Consequently, unauthenticated attackers ...
EUVD-2026-91940
The MetForm WordPress plugin before 4.3.1 does not properly restrict access to a debug file it writes to the web root on every form submission when its HubSpot Forms integration is enabled, allowing unauthenticated attackers to read upstream API response data, including correlation identifiers an...
CVE-2026-86834 MetForm 2.2.1 - 4.3.0 - Unauthenticated Debug File Disclosure via HubSpot Forms Integration
The MetForm WordPress plugin before 4.3.1 does not properly restrict access to a debug file it writes to the web root on every form submission when its HubSpot Forms integration is enabled, allowing unauthenticated attackers to read upstream API response data, including correlation identifiers an...
CVE-2026-86832: Exposure of Sensitive Information to an Unauthorized Actor
The MetForm WordPress plugin before 4.3.1 does not properly restrict access to form submission data, allowing unauthenticated attackers to view submitter information through the REST API...
PT-2026-104525
Name of the Vulnerable Software and Affected Versions MetForm WordPress plugin versions prior to 4.3.1 Description Insufficient access restrictions to form submission data allow unauthenticated attackers to view submitter information via the REST API. Recommendations Update MetForm WordPress plug...
PT-2026-104526
Name of the Vulnerable Software and Affected Versions MetForm WordPress plugin versions prior to 4.3.1 Description When the HubSpot Forms integration is enabled, the plugin fails to properly restrict access to a debug file created in the web root during every form submission. This allows...
CVE-2026-86834: Exposure of Sensitive Information to an Unauthorized Actor
The MetForm WordPress plugin before 4.3.1 does not properly restrict access to a debug file it writes to the web root on every form submission when its HubSpot Forms integration is enabled, allowing unauthenticated attackers to read upstream API response data, including correlation identifiers an...