{"uuid": "618562c8-e2e5-4d0f-b974-b8169ac80bb4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-0084", "type": "seen", "source": "https://t.me/hacking_Attack/89250", "content": "Exploit Collector\nWordPress Metform Elementor Contact Form Builder 3.1.2 Cross Site Scripting\n\nhttps://4.bp.blogspot.com/-hp3wB9AXd0k/WWlvDY5V44I/AAAAAAAAIKs/ScSIhWVAvDAhjeMkIwqbNby9r3gKQvOEgCLcBGAs/s1600/h128.png WordPress Metform Elementor Contact Form Builder plugin versions 3.1.2 and below suffer from a persistent cross site scripting vulnerability.\n\nSHA-256 | c049226eafcb4a203f2e5559ba9fda2836f1add53fb4cdf6aad29f235f957132Download Affected Plugin: Metform Elementor Contact Form Builder\n\nPlugin Slug: metform\n\nAffected Versions: <=\n\nCVE ID: CVE-2023-0084\n\nCVSS Score: 7.2 (High)\n\nCVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N\n\nResearcher/s: Mohammed El Amin, Chemouri \n\nFully Patched Version: 3.2.0\n\nThe Metform Elementor Contact Form Builder plugin allows site builders to create highly functional contact forms. Unfortunately, vulnerable versions of the Metform plugin fail to escape submitted form entries when displaying them in the admin panel.\n\nThis meant that any site visitor could fill out a contact form with malicious JavaScript, and that the script would execute in the browser of any administrator viewing that form entry.\n\nWhile sanitizing input may also have helped, escaping output is much more important for preventing Cross-Site Scripting as bypasses are far less common.\n\nThe patched version updated the format_form_data function to escape the output form data in order to address this issue.\n\nAn attacker able to execute JavaScript in the browser of an administrator can use it to take over a website via several methods, including by adding a new malicious administrator or injecting a backdoor into a plugin or theme on the site.\n\nUnauthenticated Stored Cross-Site Scripting vulnerabilities are the most dangerous variant of Cross-Site Scripting for WordPress sites as they are much easier for attackers to automatically exploit en masse without needing an existing user account.\n\nTimeline\n\nJanuary 4, 2023 - Mohammed Chemouri responsibly discloses the vulnerability to the plugin vendor and our Vulnerability Disclosure program.\n\nJanuary 8, 2023 - A patched version of the Metform plugin, 3.2.0, is made available.\n\nFebruary 3, 2023 - The Wordfence Threat Intelligence team discovers a potential bypass of the existing Cross-Site Scripting rule and releases an additional firewall rule to Wordfence Premium, Care, and Response sites.\n\nMarch 5, 2023 - The firewall rule becomes available to Wordfence free users.\n\nConclusion\n\nIn today\u2019s post we detailed an unauthenticated stored Cross-Site Scripting vulnerability in the Metform plugin discovered and responsibly disclosed by independent security researcher Mohammed Chemouri. The Wordfence firewall\u2019s built-in Cross-Site Scripting protection should provide coverage for all Wordfence users including those using Wordfence free.\n\nWhile we did find a potential bypass and deploy an additional rule to coverit, we have not seen this vulnerability exploited at a large scale in the wild, and have not seen any instances of the bypass being exploited. Nonetheless, we strongly recommend updating to the latest version of the Metform Elementor Contact Form Builder plugin, which is 3.2.1 at the time of this writing.\n\nIf you believe your site has been compromised as a result of this vulnerability or any other vulnerability, we offer Incident Response services via Wordfence Care. If you need your site cleaned immediately, Wordfence Response offers the same service with 24/7/365 availability and a 1-hour response time. Both of these products include hands-on support in case you need further assistance.\n\nIf you have any friends or colleagues who are using this plugin, please share this announcement with them and encourage them to update to the latest patched version of Metform Elementor Contact Form Builder as soon as possible.\n\nIf you are a security researcher, you can responsibly disclose your finds to us and obtain a CVE ID and get your name on the Wordfence Intelligence Community Edition leaderboard. Source:packetstormsecurity.com", "creation_timestamp": "2026-09-02T01:01:25.769179Z"}