https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-17T15:48:50.753246+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-86833 CVE-2026-86833 — MetForm < 4.3.1 - Unauthenticated HTML Injection in Notification Emails via Field Shortcodes 2026-10-17T15:48:50.754352+00:00

Affected: Unknown MetForm

The MetForm WordPress plugin before 4.3.1 does not sanitize or escape submitted form-field values before inserting them into the HTML body of its email notifications, allowing unauthenticated attackers to inject arbitrary markup into the administrator and submitter notification emails the site sends.