Unknown Metform vulnerabilities

4 CVEs affecting Unknown Metform, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-86833, published 2026-10-07.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-86813, published 2026-09-11. Medium severity, CVSS 4.8. EPSS: 0.2% chance of exploitation in the next 30 days. The MetForm WordPress plugin before 4.1.9 does not properly neutralize newline characters in user-submitted values that are placed into notification email headers, allowing unauthenticated attackers…
CVE-2026-86832, published 2026-10-03. Medium severity, CVSS 5.3. EPSS: 0.2% chance of exploitation in the next 30 days. The MetForm WordPress plugin before 4.3.1 does not properly restrict access to form submission data, allowing unauthenticated attackers to view submitter information through the REST API.
CVE-2026-86834, published 2026-10-03. Low severity, CVSS 3.7. EPSS: 0.2% chance of exploitation in the next 30 days. The MetForm WordPress plugin before 4.3.1 does not properly restrict access to a debug file it writes to the web root on every form submission when its HubSpot Forms integration is enabled, allowing…
CVE-2026-86833, published 2026-10-07. Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days. The MetForm WordPress plugin before 4.3.1 does not sanitize or escape submitted form-field values before inserting them into the HTML body of its email notifications, allowing unauthenticated…