395 matches found
CVE-2026-86833
The MetForm WordPress plugin before 4.3.1 does not sanitize or escape submitted form-field values before inserting them into the HTML body of its email notifications, allowing unauthenticated attackers to inject arbitrary markup into the administrator and submitter notification emails the site...
CVE-2026-86833 MetForm < 4.3.1 - Unauthenticated HTML Injection in Notification Emails via Field Shortcodes
The MetForm WordPress plugin before 4.3.1 does not sanitize or escape submitted form-field values before inserting them into the HTML body of its email notifications, allowing unauthenticated attackers to inject arbitrary markup into the administrator and submitter notification emails the site...
CVE-2026-86833
The MetForm WordPress plugin versions prior to 4.3.1 is vulnerable to unauthenticated HTML injection . The root cause is a failure to sanitize or escape submitted form-field values before they are inserted into the HTML body of notification emails. This allows an unauthenticated attacker to injec...
EUVD-2026-94193
The MetForm WordPress plugin before 4.3.1 does not sanitize or escape submitted form-field values before inserting them into the HTML body of its email notifications, allowing unauthenticated attackers to inject arbitrary markup into the administrator and submitter notification emails the site...
WordPress Metform <=2.1.3 - Information Disclosure
WordPress Metform plugin through 2.1.3 is susceptible to information disclosure due to improper access control in the /core/forms/action.php file. An attacker can view all API keys and secrets of integrated third-party APIs such as that of PayPal, Stripe, Mailchimp, Hubspot, HelpScout, reCAPTCHA...
CVE-2022-1442
CVE-2022-1442 WordPress 插件 Metform = 2.1.3 - 不恰当的访问控制导致未认证的敏感信息泄露 描述 由于 /core/forms/action.php 文件中存在不恰当的访问控制，该插件容易受到敏感信息泄露攻击，未认证的攻击者可以利用该漏洞查看所有集成的第三方 API 的密钥和机密信息，例如 PayPal、Stripe、Mailchimp、Hubspot、HelpScout、reCAPTCHA 等。 POC bash metform.sh http://wordpress.lan "formtitle": "New Form 1691056894",...
CVE-2026-86834
The MetForm WordPress plugin before 4.3.1 does not properly restrict access to a debug file it writes to the web root on every form submission when its HubSpot Forms integration is enabled, allowing unauthenticated attackers to read upstream API response data, including correlation identifiers an...
CVE-2026-86832
The MetForm WordPress plugin before 4.3.1 does not properly restrict access to form submission data, allowing unauthenticated attackers to view submitter information through the REST API...
EUVD-2026-91939
The MetForm WordPress plugin before 4.3.1 does not properly restrict access to form submission data, allowing unauthenticated attackers to view submitter information through the REST API...
CVE-2026-86832
The MetForm WordPress plugin, specifically versions before 4.3.1 , contains a vulnerability where it fails to properly restrict access to form submission data. This flaw allows unauthenticated attackers to view sensitive submitter information via the REST API . Exploitation details are not provid...
CVE-2026-86832 MetForm < 4.3.1 - Unauthenticated Form Entry Data Disclosure via REST API
The MetForm WordPress plugin before 4.3.1 does not properly restrict access to form submission data, allowing unauthenticated attackers to view submitter information through the REST API...
CVE-2026-86834
The MetForm WordPress plugin (versions 2.2.1 through 4.3.0) contains a vulnerability where it fails to properly restrict access to a debug file written to the web root. This occurs during every form submission when the HubSpot Forms integration is enabled. Consequently, unauthenticated attackers ...
EUVD-2026-91940
The MetForm WordPress plugin before 4.3.1 does not properly restrict access to a debug file it writes to the web root on every form submission when its HubSpot Forms integration is enabled, allowing unauthenticated attackers to read upstream API response data, including correlation identifiers an...
CVE-2026-86834 MetForm 2.2.1 - 4.3.0 - Unauthenticated Debug File Disclosure via HubSpot Forms Integration
The MetForm WordPress plugin before 4.3.1 does not properly restrict access to a debug file it writes to the web root on every form submission when its HubSpot Forms integration is enabled, allowing unauthenticated attackers to read upstream API response data, including correlation identifiers an...
CVE-2026-86834 MetForm 2.2.1 - 4.3.0 - Unauthenticated Debug File Disclosure via HubSpot Forms Integration
The MetForm WordPress plugin before 4.3.1 does not properly restrict access to a debug file it writes to the web root on every form submission when its HubSpot Forms integration is enabled, allowing unauthenticated attackers to read upstream API response data, including correlation identifiers an...
CVE-2026-86832: Exposure of Sensitive Information to an Unauthorized Actor
The MetForm WordPress plugin before 4.3.1 does not properly restrict access to form submission data, allowing unauthenticated attackers to view submitter information through the REST API...
PT-2026-104525
Name of the Vulnerable Software and Affected Versions MetForm WordPress plugin versions prior to 4.3.1 Description Insufficient access restrictions to form submission data allow unauthenticated attackers to view submitter information via the REST API. Recommendations Update MetForm WordPress plug...
PT-2026-104526
Name of the Vulnerable Software and Affected Versions MetForm WordPress plugin versions prior to 4.3.1 Description When the HubSpot Forms integration is enabled, the plugin fails to properly restrict access to a debug file created in the web root during every form submission. This allows...
CVE-2026-86834: Exposure of Sensitive Information to an Unauthorized Actor
The MetForm WordPress plugin before 4.3.1 does not properly restrict access to a debug file it writes to the web root on every form submission when its HubSpot Forms integration is enabled, allowing unauthenticated attackers to read upstream API response data, including correlation identifiers an...