CVE-2026-18100: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in roxnor MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor

CVE-2026-18100 is a stored cross-site scripting vulnerability in the MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor WordPress plugin. The flaw exists in all versions up to 4.1.8 due to insufficient input sanitization and output escaping of the 'mf_form_id' widget setting. Authenticated attackers with contributor-level privileges can inject arbitrary JavaScript payloads that execute in the context of users viewing the compromised pages. The payload bypasses Elementor's wp_kses_post filter by containing no HTML tags and leverages MetForm's str_replace transformation of script tags into JavaScript template literals to evade detection.

An attacker with contributor-level access or higher can inject persistent malicious scripts into pages, potentially leading to session hijacking, privilege escalation, or other attacks against users who view the injected content. The vulnerability affects confidentiality and integrity but does not impact availability. The CVSS score of 6.4 (medium severity) reflects the moderate risk given the required authentication level and the potential for cross-site scripting impact.

No official patch or fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict contributor-level access to trusted users only and consider disabling or limiting use of the vulnerable 'mf_form_id' widget setting to reduce exposure.