CVE-2023-0084

Deeper analysis

The Metform Elementor Contact Form Builder plugin for WordPress is affected by a stored cross-site scripting vulnerability (CWE-79) in versions up to and including 3.1.2. The flaw resides in the handling of text areas within forms, where insufficient input sanitization and output escaping allow arbitrary script injection that persists and executes on the submissions page.

Unauthenticated attackers can exploit the issue over the network by submitting crafted form input that stores malicious scripts. When an administrator or other user later views the submissions page, the scripts execute in the victim's browser context, enabling actions such as session hijacking or unauthorized data access with a CVSS 3.1 score of 7.2.

Public references, including the Wordfence advisory and the WordPress plugin trac changeset, indicate that the issue was addressed by updating the plugin to a version containing improved sanitization and escaping. Site administrators are advised to apply the available patch or upgrade beyond 3.1.2.

EPSS for this CVE rose from lower values to a peak of 0.5949 before receding to the current 0.4784, indicating post-disclosure exploitation interest that warrants monitoring.