The Wpmet Metform plugin contains a stored cross-site scripting vulnerability due to improper input neutralization during web page generation. This flaw affects all versions from the initial release through 4.3.0, enabling attackers with limited privileges to inject malicious scripts that execute in the context of other users. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requiring privileges and user interaction, with impacts on confidentiality, integrity, and availability.

Successful exploitation can lead to execution of arbitrary scripts in the context of affected users, potentially compromising user data confidentiality, integrity, and availability. The vulnerability requires attacker privileges and user interaction, limiting but not eliminating risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, limit privileges of users who can submit input and apply web application firewall rules to detect and block XSS payloads if possible.