Metform (Unknown) - vulnerabilities (CVEs)

4 CVEs, 3 in the last 30 days, 1 known versions, newest CVE from 2026-10-07. Vendor: Unknown.

CVEs of Metform

• CVE-2026-86833 - CVSS 5.4 (medium), 2026-10-07: The MetForm WordPress plugin before 4.3.1 does not sanitize or escape submitted form-field values before inserting them into the HTML body of its email…
• CVE-2026-86834 - CVSS 3.7 (low), 2026-10-03: The MetForm WordPress plugin before 4.3.1 does not properly restrict access to a debug file it writes to the web root on every form submission when its…
• CVE-2026-86832 - CVSS 5.3 (medium), 2026-10-03: The MetForm WordPress plugin before 4.3.1 does not properly restrict access to form submission data, allowing unauthenticated attackers to view submitter…
• CVE-2026-86813 - CVSS 4.8 (medium), 2026-09-11: The MetForm WordPress plugin before 4.1.9 does not properly neutralize newline characters in user-submitted values that are placed into notification email…