The MetForm Elementor Contact Form Builder plugin for WordPress suffers from a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of input during web page generation. This vulnerability allows authenticated users with contributor-level or higher privileges to inject malicious scripts via the plugin's shortcodes because the plugin does not sufficiently sanitize or escape user-supplied attributes. These scripts execute in the context of any user who accesses the injected page, potentially leading to information disclosure or session hijacking. The issue affects all versions up to 3.8.3. The CVSS 3.1 base score is 6.4, reflecting network attack vector, low attack complexity, privileges required, no user interaction, and impact on confidentiality and integrity but not availability.

An attacker with contributor-level or higher permissions can inject persistent malicious scripts into pages using the vulnerable plugin's shortcodes. These scripts execute in the browsers of users who view the affected pages, potentially allowing theft of sensitive information or unauthorized actions within the context of the victim's session. The impact affects confidentiality and integrity but does not affect availability. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, users should monitor the vendor's communications for updates. Until a fix is available, restrict contributor-level permissions to trusted users only and consider disabling or removing the MetForm plugin if possible to reduce exposure.