Veille CVE

Recherche « Unknown MetForm »

4 CVE

Critique 0 Élevée 0 Moyenne 3 Faible 1 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Unknown MetForm » ✕
  1. CVE-2026-86833 5.4 Moyenne

    Unknown MetForm

    The MetForm WordPress plugin before 4.3.1 does not sanitize or escape submitted form-field values before inserting them into the HTML body of its email notifications, allowing unauthenticated attackers to inject arbitrary markup into the administrator and submitter notification emails the site sends.

  2. CVE-2026-86834 3.7 Faible

    Unknown MetForm

    The MetForm WordPress plugin before 4.3.1 does not properly restrict access to a debug file it writes to the web root on every form submission when its HubSpot Forms integration is enabled, allowing unauthenticated attackers to read upstream API response data, including correlation identifiers and cookies.

  3. CVE-2026-86832 5.3 Moyenne

    Unknown MetForm

    The MetForm WordPress plugin before 4.3.1 does not properly restrict access to form submission data, allowing unauthenticated attackers to view submitter information through the REST API.

  4. CVE-2026-86813 4.8 Moyenne

    Unknown MetForm

    The MetForm WordPress plugin before 4.1.9 does not properly neutralize newline characters in user-submitted values that are placed into notification email headers, allowing unauthenticated attackers to inject additional email headers, such as Bcc, into the emails the site sends when a submitted field value is configured to populate a header.