Wpmet vulnerabilities
We track 14 vulnerabilities in Wpmet products across 9 products. 14 are rated high or critical, and none are known to be exploited. The most recent was published on March 10, 2026.
Latest Wpmet vulnerabilities
- 7.2 High severity
MetForm Pro: Improper Neutralization of Input During Web Page Generation
The MetForm Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Quiz feature in all versions up to, and including, 3.9.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers
- 9.8 Critical severity
Metform: Missing Authorization
Missing Authorization vulnerability in Roxnor Metform metform allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Metform: from n/a through <= 3.4.0.
- 9.8 Critical severity
GutenKit – Page Builder Blocks, Patterns, and…: Missing Authorization
The GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor plugin for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the install_and_activate_plugin_from_external() function (install-active-pl
- 9.8 Critical severity
MetForm – Contact Form, Survey, Quiz, & Custom…: Unrestricted Upload of File with Dangerous Type
The Metform Elementor Contact Form Builder for WordPress is vulnerable to Arbitrary File Upload due to insufficient file type validation in versions up to, and including, 3.2.4. This allows unauthenticated visitors to perform a "double extension" attack and up
- 8.8 High severity
FundEngine – Donation and Crowdfunding Platform: Missing Authorization
The FundEngine plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.7.0. This is due to the plugin not properly verifying user meta updated through the update_user_meta function. This makes it possible for authenti
- 9.6 Critical severity
ElementsKit Pro: Server-Side Request Forgery
The ElementsKit PRO plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 3.6.2 via the 'render_raw' function. This can allow authenticated attackers, with contributor-level permissions and above, to make web reque
- 7.5 High severity
MetForm – Contact Form, Survey, Quiz, & Custom…: Exposure of Sensitive Information to an Unauthorized Actor
The MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 3.8.8 via the 'handle_file' function. This can allow unauthenticated attackers
- 8.8 High severity
ElementsKit Pro: Improper Control of Filename for Include/Require Statement in PHP Program
The ElementsKit Pro plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.6.0 via the Price Menu, Hotspot, and Advanced Toggle widgets. This makes it possible for authenticated attackers, with contributor-level acce
- 8.8 High severity
ElementsKit Elementor Addons – Advanced…: Improper Control of Filename for Include/Require Statement in PHP Program
The ElementsKit Elementor addons plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.1.0 via the generate_navigation_markup function of the Onepage Scroll module. This makes it possible for authenticated attackers
- 7.5 High severity
Wp Ultimate Review: Authorization Bypass Through User-Controlled Key
Authorization Bypass Through User-Controlled Key vulnerability in Wpmet Wp Ultimate Review.This issue affects Wp Ultimate Review: from n/a through 2.2.5.
- 8.8 High severity
ElementsKit Elementor Addons – Advanced…: Improper Control of Filename for Include/Require Statement in PHP Program
The ElementsKit Elementor addons plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.0.6 via the render_raw function. This makes it possible for authenticated attackers, with contributor-level access and above, to
- 7.8 High severity
MetForm – Contact Form, Survey, Quiz, & Custom…: Improper Neutralization of Formula Elements in a CSV File
The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to CSV injection in versions up to, and including, 3.3.0. This allows unauthenticated attackers to embed untrusted input into exported CSV files, which can result in code execution w
- 9.8 Critical severity
WP Fundraising Donation and Crowdfunding…: Improper Neutralization of Special Elements used in an SQL Command
The WP Fundraising Donation and Crowdfunding Platform WordPress plugin before 1.5.0 does not sanitise and escape a parameter before using it in a SQL statement via one of it's REST route, leading to an SQL injection exploitable by unauthenticated users
- 7.5 High severity
MetForm – Contact Form, Survey, Quiz, & Custom…: Missing Authorization
The Metform WordPress plugin is vulnerable to sensitive information disclosure due to improper access control in the ~/core/forms/action.php file which can be exploited by an unauthenticated attacker to view all API keys and secrets of integrated third-party A