CVE-2026-86833: CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') in MetForm

The MetForm WordPress plugin prior to version 4.3.1 does not properly sanitize or escape submitted form-field values before embedding them into the HTML content of email notifications. This improper neutralization of special elements (CWE-74) enables unauthenticated attackers to inject arbitrary markup into both administrator and submitter notification emails generated by the site. The vulnerability has a CVSS 3.1 base score of 5.4, indicating a medium severity level with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality and integrity but not availability.

An attacker can inject arbitrary HTML markup into email notifications sent by the vulnerable MetForm plugin. This could potentially lead to phishing or social engineering attacks by manipulating the content of emails received by administrators and submitters. However, the vulnerability does not impact system availability and requires user interaction to trigger the malicious content.

A fix is available in MetForm version 4.3.1. Users should upgrade to version 4.3.1 or later to remediate this vulnerability. No other mitigation is specified or required once the plugin is updated.