Vulnerability history

Authenticated (Contributor+) Stored Cross-Site Scripting via 'mf_form_id' Widget Setting vulnerability

WordPress MetForm - Contact Form, Survey, Quiz, & Custom Form Builder for Elementor plugin <= 4.1.0 - Unauthenticated Form Submission Exposure via Forgeable Cookie Value vulnerability

Authenticated(Contributor+) Stored Cross-Site Scripting via `mf-template` DOM Element vulnerability

Server Side Request Forgery (SSRF) vulnerability

Unauthenticated Double-Extension Arbitrary File Upload vulnerability

Unauthenticated Sensitive Information Exposure vulnerability

Broken Access Control vulnerability

Authenticated (Contributor+) Stored Cross-Site Scripting via Widgets vulnerability

Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode vulnerability

Cross-Site Request Forgery vulnerability

Broken Access Control vulnerability

Authenticated (Subscriber+) Information Disclosure via 'mf_first_name' shortcode vulnerability

Cross-Site Request Forgery via permalink_setup vulnerability

Authenticated (Subscriber+) Information Disclosure via 'mf_payment_status' shortcode vulnerability

Unauthenticated CSV Injection vulnerability

Authenticated (Contributor+) Stored Cross-Site Scripting via mf_first_name shortcode vulnerability

Authenticated (Subscriber+) Information Disclosure via mf_last_name shortcode vulnerability

Authenticated (Subscriber+) Information Disclosure via mf_thankyou shortcode vulnerability

Authenticated (Contributor+) Stored Cross-Site Scripting via mf_last_name shortcode vulnerability

Authenticated (Subscriber+) Information Disclosure via 'mf_transaction_id' shortcode vulnerability

Authenticated (Contributor+) Stored Cross-Site Scripting via mf shortcode vulnerability

Authenticated (Subscriber+) Information Disclosure via mf shortcode vulnerability

Missing Authorization vulnerability

reCaptcha Protection Bypass vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated API keys and Secrets Disclosure vulnerability