The Metform Elementor Contact Form Builder plugin for WordPress suffers from a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of input during web page generation. This vulnerability allows authenticated users with contributor-level privileges or above to inject malicious scripts via plugin widgets because user inputs are not properly sanitized or escaped before being rendered. The vulnerability affects all plugin versions up to 3.8.5. Exploitation results in script execution in the context of users visiting the compromised pages, potentially leading to information disclosure or session hijacking. The CVSS 3.1 base score is 6.4, reflecting a medium severity with network attack vector, low attack complexity, and no user interaction required. No patch or remediation details have been provided by the vendor yet.

Successful exploitation allows authenticated contributors or higher to inject and execute arbitrary scripts in the context of users viewing the affected pages. This can lead to information disclosure and integrity impacts, such as theft of session tokens or manipulation of page content. Availability is not affected. The vulnerability requires authenticated access with contributor privileges or higher, limiting the attack surface to users with some level of trust within the WordPress environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and monitor for suspicious activity. Avoid using affected plugin versions if possible. Follow vendor channels for updates regarding patches or official mitigations.