MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor Security & Risk Analysis
wordpress.org/plugins/metformThe most popular Elementor forms builder to create WordPress forms like contact forms, booking forms, feedback form, survey forms, application forms a …
Is MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor Safe to Use in 2026?
Generally Safe
Score 87/100MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor has a strong security track record. Known vulnerabilities have been patched promptly.
The Metform plugin, version 4.1.3, exhibits a mixed security posture. On the positive side, it demonstrates good practices with 100% of its SQL queries using prepared statements and a high percentage (90%) of output properly escaped. The absence of critical or high-severity taint analysis findings is also encouraging, suggesting that core data handling might be relatively secure. The plugin also implements a good number of nonce and capability checks, indicating an awareness of common WordPress security mechanisms.
However, significant concerns arise from its vulnerability history and attack surface. The plugin has a substantial track record of 26 known CVEs, with a recent vulnerability in January 2026, although none are currently unpatched. The common vulnerability types, including Improper Authentication, SSRF, Unrestricted Uploads, and XSS, suggest recurring weaknesses in how user input is handled and access controls are implemented. The attack surface analysis reveals 15 total entry points, with one AJAX handler lacking authentication checks, which represents a direct, exploitable vulnerability if that handler is accessible and processable without proper authorization.
Overall, while Metform has some strengths in its code, the extensive and recurring vulnerability history, coupled with a less-than-fully-protected attack surface, points to a plugin that requires careful monitoring and prompt updating. Users should be aware of the past issues and ensure they are on the latest version to mitigate risks from historical vulnerabilities.
Key Concerns
- AJAX handler without auth check
- Extensive vulnerability history (26 CVEs)
- Recurring high-severity vulnerability types
MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor Security Vulnerabilities
CVEs by Year
Severity Breakdown
26 total CVEs
MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor <= 4.1.0 - Unauthenticated Form Submission Exposure via Forgeable Cookie Value
MetForm <= 4.0.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via `mf-template` DOM Element
Metform <= 3.9.2 - Authenticated (Admin+) Server-Side Request Forgery
Metform Elementor Contact Form Builder <= 3.2.4 - Unauthenticated Double-Extension Arbitrary File Upload
MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor <= 3.8.8 - Unauthenticated Sensitive Information Exposure
Metform Elementor Contact Form Builder <= 3.8.3 - Missing Authorization to Notice Dismissal
Metform Elementor Contact Form Builder <= 3.8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widgets
Metform Elementor Contact Form Builder <= 3.8.3 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode
Metform Elementor Contact Form Builder <= 3.8.1 - Cross-Site Request Forgery
Metform Elementor Contact Form Builder <= 3.4.0 - Missing Authorization via submit
Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via 'mf_first_name' shortcode
Metform Elementor Contact Form Builder <= 3.3.2 - Cross-Site Request Forgery via permalink_setup
Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via mf shortcode
Metform Elementor Contact Form Builder <= 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via mf shortcode
Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via 'mf_transaction_id' shortcode
Metform Elementor Contact Form Builder <= 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via mf_last_name shortcode
Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via mf_thankyou shortcode
Metform Elementor Contact Form Builder <= 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via mf_thankyou shortcode
Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via mf_last_name shortcode
Metform Elementor Contact Form Builder <= 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via mf_first_name shortcode
Metform Elementor Contact Form Builder <= 3.3.0 - Unauthenticated CSV Injection
Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via 'mf_payment_status' shortcode
Metform Elementor Contact Form Builder <= 3.3.0 - Missing Authorization
Metform Elementor Contact Form Builder <= 3.2.1 - reCaptcha Protection Bypass
Metform Elementor Contact Form Builder <= 3.1.2 - Unauthenticated Stored Cross-Site Scripting
Metform Elementor Contact Form Builder <= 2.1.3 - Sensitive Information Disclosure
MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor Code Analysis
Bundled Libraries
SQL Query Safety
Output Escaping
Data Flow Analysis
MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor Attack Surface
AJAX Handlers 8
Shortcodes 7
WordPress Hooks 74
Maintenance & Trust
MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor Maintenance & Trust
Maintenance Signals
Community Trust
MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor Alternatives
RTMForm Builder
romethemeform
RTMForm For Elementor Plugin is an Form Builder for Elementor, and Widget Ready to use.
Easy Custom Forms
easy-custom-forms
Create custom forms easily with a user-friendly interface and powerful features.
WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More
wpforms-lite
The best WordPress contact form plugin. Drag & Drop form builder to create beautiful contact forms, payment forms, & other custom forms.
Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder
fluentform
Get a fast contact form plugin. Create advanced forms using drag and drop form builder with all smart features.
SureForms – Contact Form, Payment Form & Other Custom Form Builder
sureforms
The most beginner-friendly, AI Form Builder for WordPress to create contact forms, payment forms & other custom forms with advanced features, with …
MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor Developer Profile
15 plugins · 3.0M total installs
How We Detect MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor
Patterns used to identify this plugin on WordPress sites during automated security audits and web crawling.
Asset Fingerprints
/wp-content/plugins/metform/assets/css/metform-ui.css/wp-content/plugins/metform/assets/css/metform-style.css/wp-content/plugins/metform/assets/js/htm.js/wp-content/plugins/metform/assets/js/metform-app.js/wp-content/plugins/metform/assets/js/htm.js/wp-content/plugins/metform/assets/js/metform-app.jsmetform/assets/css/metform-ui.css?ver=metform/assets/css/metform-style.css?ver=metform/assets/js/htm.js?ver=metform/assets/js/metform-app.js?ver=HTML / DOM Fingerprints
mf-form-shortcodecheck transient id and session hashed token<div class="mf-form-shortcode">mf-listing-fnamemf-listing-lname