WP Vulnerability WatchVulnerability data as of September 7, 2026

Known vulnerabilities in MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor

Elementor forms builder to create WordPress forms like contact form, booking form, feedback form, survey form, application form & 40+ form templates.

26Reported vulnerabilities
9.8Highest CVSS score
4.2.0Latest version
600,000+Active installs

What to do now

Update MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor to 4.1.9 or later. 26 of these have a fixed version available. Updating resolves them.

Plugin last updated: August 12, 2026 / Tested up to WordPress: 7.0.4 / View on wordpress.org

Reported vulnerabilities

Ordered by how urgently they need attention — whether a vulnerability is actually being exploited, and how likely exploitation is, rather than CVSS severity alone.

CVESeverityExploit probability
next 30 days		 Affected versionsFixed inPublished
CVE-2023-0084 Medium 6.1 28.6% 3.1.2 and earlier 3.2.0 March 2, 2023
CVE-2022-1442 High 7.5 8.8% Before 2.1.4 2.1.4 May 10, 2022
CVE-2023-0714 Critical 9.8 1.0% Before 3.3.0 3.3.0 August 17, 2024
CVE-2023-0721 High 7.8 0.7% 3.3.0 and earlier 3.3.1 June 9, 2023
CVE-2024-4266 High 7.5 0.5% Before 3.8.9 3.8.9 June 11, 2024
CVE-2023-0688 Medium 6.5 0.7% 3.3.1 and earlier 3.3.2 June 9, 2023
CVE-2026-18100 Medium 6.4 0.2% 0 to 4.1.8 (inclusive) 4.1.9 August 25, 2026
CVE-2025-5684 Medium 6.4 0.2% 0 to 4.0.1 (inclusive) 4.0.2 July 29, 2025
CVE-2025-30914 Medium 5.5 0.3% 3.9.2 and earlier 3.9.3 March 27, 2025
CVE-2024-2791 Medium 5.4 0.3% Before 3.8.6 3.8.6 April 2, 2024
CVE-2024-1585 Medium 5.4 0.5% Before 3.8.4 3.8.4 March 13, 2024
CVE-2023-50903 Medium 5.3 0.6% 3.4.0 and earlier 3.4.1 December 26, 2023
CVE-2023-1843 Medium 5.3 0.6% 3.3.0 and earlier 3.3.2 June 9, 2023
CVE-2023-0710 Medium 5.4 0.4% 3.3.0 and earlier 3.3.1 June 9, 2023
CVE-2023-0709 Medium 5.4 0.6% 3.3.0 and earlier 3.3.1 June 9, 2023
CVE-2023-0708 Medium 5.4 0.6% 3.3.0 and earlier 3.3.1 June 9, 2023
CVE-2023-0695 Medium 5.4 0.4% 3.3.0 and earlier 3.3.1 June 9, 2023
CVE-2023-0085 Medium 5.3 0.7% 3.2.1 and earlier 3.2.2 March 2, 2023
CVE-2023-6788 Medium 5.4 0.2% 3.8.1 and earlier 3.8.2 January 9, 2024
CVE-2023-0689 Medium 4.3 0.6% Before 3.3.2 3.3.2 August 31, 2023
CVE-2023-0694 Medium 4.3 0.7% 3.3.1 and earlier 3.3.2 June 9, 2023
CVE-2023-0693 Medium 4.3 0.7% 3.3.1 and earlier 3.3.2 June 9, 2023
CVE-2023-0692 Medium 4.3 0.6% 3.3.1 and earlier 3.3.2 June 9, 2023
CVE-2023-0691 Medium 4.3 0.6% 3.3.1 and earlier 3.3.2 June 9, 2023
CVE-2023-2517 Medium 4.3 0.4% Before 3.3.3 3.3.3 July 12, 2023
CVE-2026-0633 Low 3.7 0.2% 0 to 4.1.0 (inclusive) 4.1.1 January 24, 2026

Sources: vulnerability records from NVD, exploitation from CISA KEV, exploit probability from EPSS. Affected versions come from CPE ranges or from the reporting CNA.