Cross-Site Scripting Vulnerability in Metform Contact Form Builder by WordPress

CVE-2023-0708

Summary

The Metform Elementor Contact Form Builder for WordPress contains a vulnerability that allows authenticated attackers with contributor-level permissions or higher to inject arbitrary scripts. This is accomplished through the use of the 'mf_first_name' shortcode, which improperly handles unescaped form submissions in pages. When a victim visits a page that includes the shortcode and submission ID in the query string, the injected script executes. Although user interaction is required to trigger the script, it poses significant risks as the malicious JavaScript is stored in the site database.

References