CVE-2026-103339: Wpmet Metform XSS Vulnerability

CVE-2026-103339 Overview

CVE-2026-103339 is a stored Cross-Site Scripting (XSS) vulnerability in the Wpmet Metform WordPress plugin. The flaw affects all versions of Metform up to and including 4.3.0. Attackers with low-privileged authenticated access can inject malicious scripts that persist in the application and execute in the browsers of visitors or administrators. The vulnerability is classified under [CWE-79] (Improper Neutralization of Input During Web Page Generation).

Exploitation requires user interaction and crosses a security boundary, allowing the attacker to affect resources beyond the vulnerable component's scope. Successful attacks can lead to session hijacking, credential theft, or unauthorized actions performed under the context of the victim.

Critical Impact

An authenticated attacker can inject persistent JavaScript into Metform forms, enabling theft of session cookies, administrative action abuse, and defacement of rendered pages across the WordPress site.

Affected Products

• Wpmet Metform plugin for WordPress — all versions through 4.3.0
• WordPress sites running the vulnerable Metform plugin with form-building features exposed to contributors or higher
• Any downstream site visitors or administrators rendering attacker-controlled form content

Discovery Timeline

• 2026-10-01 - CVE-2026-103339 published to the National Vulnerability Database (NVD)
• 2026-10-01 - Last updated in NVD database

Technical Details for CVE-2026-103339

Vulnerability Analysis

Metform is a WordPress form-builder plugin that accepts user-supplied input across multiple form fields and configuration options. The plugin fails to properly neutralize input before rendering it inside generated web pages. As a result, attacker-supplied HTML or JavaScript is stored in the WordPress database and later served to other users.

The stored nature of this flaw differentiates it from reflected XSS. Payloads persist across sessions and execute automatically whenever a victim loads the affected page. Because the vulnerability's scope is marked as changed, injected scripts can access resources outside the plugin's immediate security context, including the WordPress administrative interface.

Attackers only need low-privileged authenticated access to inject payloads, which lowers the barrier for exploitation in multi-author WordPress deployments.

Root Cause

The root cause is missing or insufficient output encoding when the plugin writes user-controlled data back into HTML contexts. Input accepted through Metform's form configuration, submission handlers, or field rendering routines is not sanitized with WordPress functions such as esc_html(), esc_attr(), or wp_kses() before being echoed to the DOM.

Attack Vector

The attack is delivered over the network. An authenticated user with contributor-level privileges or above submits a crafted form field or configuration value containing a JavaScript payload. The payload is stored in the WordPress database. When any site visitor or administrator loads a page rendering that stored content, the script executes in the victim's browser under the site's origin.

The vulnerability mechanism is described in the Patchstack XSS Vulnerability Report. No verified public exploit code is currently available.

Detection Methods for CVE-2026-103339

Indicators of Compromise

• Unexpected <script> tags, javascript: URIs, or on* event handler attributes stored in Metform form metadata or wp_postmeta entries
• Outbound HTTP requests from administrator browsers to unfamiliar domains shortly after loading pages containing Metform forms
• New or unexpected administrator accounts created shortly after a contributor interacted with the Metform plugin

Detection Strategies

• Review the WordPress database for Metform-related rows containing HTML tags, encoded script payloads, or suspicious attribute values
• Enable WordPress audit logging to track form creation and modification events performed by non-administrator roles
• Deploy a Content Security Policy (CSP) in report-only mode to surface inline script execution originating from Metform-rendered pages

Monitoring Recommendations

• Monitor web server logs for POST requests to Metform endpoints from low-privileged accounts followed by GETs from administrator sessions
• Alert on anomalous DOM-based network activity from authenticated admin sessions interacting with form pages
• Track plugin version inventory across all WordPress instances to identify installations still running Metform 4.3.0 or earlier

How to Mitigate CVE-2026-103339

Immediate Actions Required

• Update Metform to a version later than 4.3.0 once the vendor releases a patched build
• Audit WordPress user roles and remove contributor or author permissions from accounts that do not require them
• Inspect existing Metform form configurations and submissions for stored payloads and remove any malicious content

Patch Information

Refer to the Patchstack advisory for Metform for the latest patch availability and fixed version information. Apply the vendor-supplied update through the WordPress plugin manager or by replacing the plugin files directly.

Workarounds

• Restrict Metform form editing capabilities to trusted administrators until a patched version is deployed
• Deploy a Web Application Firewall (WAF) rule to filter script tags and event handler attributes submitted to Metform endpoints
• Enforce a strict Content Security Policy that disallows inline scripts and untrusted script sources on pages rendering Metform content

# Example CSP header to limit inline script execution on WordPress pages
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'"