CVE-2026-18100 Overview
CVE-2026-18100 is a Stored Cross-Site Scripting (XSS) vulnerability in the MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor plugin for WordPress. The flaw exists in all versions up to and including 4.1.8 and stems from insufficient input sanitization and output escaping in the mf_form_id widget setting. Authenticated attackers with contributor-level access or above can inject arbitrary JavaScript that executes in the browser of any user who views the affected page. The vulnerability is tracked under CWE-79: Improper Neutralization of Input During Web Page Generation.
Critical Impact
Authenticated contributors can inject persistent JavaScript into WordPress pages, enabling session theft, administrative action hijacking, and drive-by redirection against site visitors and administrators.
Affected Products
- MetForm plugin for WordPress — all versions up to and including 4.1.8
- Deployments using MetForm with Elementor page builder
- WordPress sites permitting contributor-level or higher account registration
Discovery Timeline
- 2026-08-25 - CVE-2026-18100 published to NVD
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-18100
Vulnerability Analysis
The vulnerability lives in MetForm's form widget rendering pipeline, where the mf_form_id widget setting is written into page output without adequate escaping. Elementor applies wp_kses_post as a save-time filter on widget settings, but that filter only strips disallowed HTML tags and attributes. Because the malicious payload contains no HTML tags, it passes through the filter unchanged and is persisted to the database. When the page is rendered, the unescaped value reaches the browser context and executes as script.
A secondary delivery path exists in MetForm's own utility layer, where a str_replace transformation rewrites script tags into JavaScript template literal expressions. This transformation effectively converts filtered content back into an executable form, defeating the sanitization boundary that WordPress site owners assume Elementor enforces.
Root Cause
The root cause is a combination of missing output escaping on the mf_form_id setting and an unsafe string transformation in MetForm's form-picker utility code. Relevant code paths are visible in form-picker-utils.php line 45, util.php line 605, and widgets/form.php line 143. The plugin trusts widget-setting input rather than applying context-appropriate escaping such as esc_attr or esc_html at render time.
Attack Vector
An authenticated user with contributor privileges edits an Elementor page containing a MetForm widget and supplies a crafted value for mf_form_id. The payload avoids HTML tags to bypass wp_kses_post and instead leverages template literal syntax that MetForm's str_replace converts into executable JavaScript. The stored payload executes in the browser of any visitor or administrator who views the injected page, enabling cookie theft, forced administrative requests, or account takeover through cross-scope script execution. Refer to the Wordfence advisory for additional exploitation context.
Detection Methods for CVE-2026-18100
Indicators of Compromise
- Elementor page metadata containing mf_form_id values with JavaScript template literal syntax such as ${...} or unexpected backtick characters
- Unexplained edits to posts or pages by contributor-role accounts, especially additions of MetForm widgets
- Outbound requests from administrator sessions to unfamiliar domains shortly after visiting content pages
Detection Strategies
- Audit the wp_postmeta table for _elementor_data entries containing mf_form_id values with non-numeric content or scripting constructs
- Deploy a web application firewall rule that inspects Elementor heartbeat and editor REST endpoints for suspicious mf_form_id payloads
- Correlate contributor account edit activity with new or modified pages that include MetForm widgets
Monitoring Recommendations
- Enable WordPress audit logging for post revisions, user role changes, and plugin configuration changes
- Monitor browser Content Security Policy (CSP) violation reports for inline script executions on MetForm-enabled pages
- Alert on privilege escalations or new administrator account creation following contributor edits
How to Mitigate CVE-2026-18100
Immediate Actions Required
- Update the MetForm plugin to the version released in changeset 3639278 or later
- Review contributor and author accounts, removing untrusted or dormant users
- Inspect existing Elementor pages for injected mf_form_id payloads and revert malicious revisions
Patch Information
The vendor addressed the vulnerability in the MetForm changeset that supersedes version 4.1.8. Site owners should upgrade through the WordPress plugin dashboard and verify the installed version is greater than 4.1.8 afterward. Consult the Wordfence vulnerability record for the fixed version reference.
Workarounds
- Temporarily restrict contributor and author roles from editing pages that include MetForm widgets
- Deploy a Content Security Policy that disallows inline script execution on front-end pages
- Disable the MetForm plugin until the patched version is deployed if contributor-level registration is public
# Verify installed MetForm version via WP-CLI
wp plugin get metform --field=version
# Update MetForm to the latest patched release
wp plugin update metform
# Audit Elementor postmeta for suspicious mf_form_id values
wp db query "SELECT post_id, meta_value FROM wp_postmeta WHERE meta_key='_elementor_data' AND meta_value LIKE '%mf_form_id%';"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
