Hur vet jag om min sajt är påverkad?

Kör ett gratis test på sitesupport.co/testa-din-hemsida. Testet kontrollerar vilka tillägg och versioner du använder och jämför mot kända sårbarheter.

Vad ska jag göra om jag har en sårbar version?

Uppdatera till senaste versionen så snart som möjligt. Om ingen fix finns tillgänglig, överväg att tillfälligt inaktivera tillägget.

MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor

Name: MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor
Rating: 4.7

4.7/5

600 000+ installationer

The most popular Elementor forms builder to create WordPress forms like contact forms, booking forms, feedback form, survey forms, application forms a …

Kända sårbarheter

Kritiska / höga

2026-01-24

Senaste sårbarhet

600 000+

Aktiva installationer

Om MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor

MetForm är ett populärt WordPress-tillägg som används för att bygga formulär i Elementor, som kontaktformulär, enkäter och bokningsformulär. Med över 600 000 aktiva installationer är det ett av de mest använda formulärbyggarna för Elementor.

Säkerhetsläget för MetForm

Tillägget har 24 dokumenterade sårbarheter, vilket är en relativt hög siffra. Fördelningen visar på allvarliga säkerhetsproblem: 1 kritisk, 3 höga och 19 medium-sårbarheter. Den kritiska sårbarheten och de höga riskerna kan potentiellt användas för att få obehörig åtkomst till webbplatsen eller stjäla känslig information.

Vad betyder detta i praktiken?

Sårbarheter i formulärtillägg är särskilt känsliga eftersom de ofta hanterar användardata och kan vara en ingångsport för attacker. En kritisk sårbarhet innebär att webbplatsen kan vara allvarligt exponerad om tillägget inte hålls uppdaterat.

Våra rekommendationer

Säkerställ att tillägget alltid körs i senaste versionen
Överväg alternativa formulärlösningar om säkerheten är kritisk för er verksamhet
Implementera extra säkerhetslager som brandväggar och säkerhetstillägg
Begränsa åtkomsten till formuläradministration

Regelbundna uppdateringar är det viktigaste skyddet mot kända sårbarheter. Håll både WordPress, teman och alla tillägg uppdaterade för optimal säkerhet.

Använder du MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor?

Kör ett gratis test och se om din hemsida är påverkad av dessa sårbarheter.

Testa din hemsida

Alla kända sårbarheter

Låg 2026-01-24 CVE-2026-0633

CVE-2026-0633: The MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 4.1.0. This is...

Påverkade versioner: <= 4.1.2

The MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 4.1.0. This is due to the use of a forgeable cookie value derived onl...

Låg 2026-01-23 CVE-2026-0633

MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor <= 4.1.0 - Unauthenticated Form Submission Exposure via Forgeable Cookie Value

Påverkade versioner: <= 4.1.0

Medel 2026-01-07 CVE-2025-14059

CVE-2025-14059: The EmailKit plugin for WordPress is vulnerable to Arbitrary File Read via Path Traversal in all versions up to, and including, 1.6.1. This is due to missing path validation in the create_template ...

Påverkade versioner: all

The EmailKit plugin for WordPress is vulnerable to Arbitrary File Read via Path Traversal in all versions up to, and including, 1.6.1. This is due to missing path validation in the create_template REST API endpoint where user-controlled input from th...

Medel 2025-07-29 CVE-2025-5684

CVE-2025-5684: The MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `mf-template` DOM Element in all versions u...

Påverkade versioner: all

The MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `mf-template` DOM Element in all versions up to, and including, 4.0.1 due to insufficient input sa...

Medel 2025-07-29 CVE-2025-5684

MetForm <= 4.0.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via `mf-template` DOM Element

Påverkade versioner: <= 4.0.1

Medel 2025-03-27 CVE-2025-30914

Metform <= 3.9.2 - Authenticated (Admin+) Server-Side Request Forgery

Påverkade versioner: <= 3.9.2

Kritisk 2024-08-17 CVE-2023-0714

CVE-2023-0714: The Metform Elementor Contact Form Builder for WordPress is vulnerable to Arbitrary File Upload due to insufficient file type validation in versions up to, and including, 3.2.4. This allows unauthe...

Påverkade versioner: < 3.3.0

The Metform Elementor Contact Form Builder for WordPress is vulnerable to Arbitrary File Upload due to insufficient file type validation in versions up to, and including, 3.2.4. This allows unauthenticated visitors to perform a "double extension" att...

Hög 2024-06-11 CVE-2024-4266

CVE-2024-4266: The MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 3.8.8 via the ...

Påverkade versioner: < 3.8.9

The MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 3.8.8 via the 'handle_file' function. This can allow unauthenticated...

Medel 2024-04-02 CVE-2024-2791

CVE-2024-2791: The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions up to, and including, 3.8.5 due to insufficient...

Påverkade versioner: < 3.8.6

The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions up to, and including, 3.8.5 due to insufficient input sanitization and output escaping on user suppl...

Medel 2024-03-13 CVE-2024-1585

CVE-2024-1585: The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 3.8.3 due to insuffi...

Påverkade versioner: < 3.8.4

The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 3.8.3 due to insufficient input sanitization and output escaping on user...

Medel 2024-01-09 CVE-2023-6788

CVE-2023-6788: The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.8.1. This is due to missing or incorrect nonce va...

Påverkade versioner: <= 3.8.1

The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.8.1. This is due to missing or incorrect nonce validation on the contents function. This makes it poss...

Medel 2023-08-31 CVE-2023-0689

CVE-2023-0689: The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf_first_name' shortcode in versions up to, and including, 3.3.1. This allows authenticated...

Påverkade versioner: < 3.3.2

The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf_first_name' shortcode in versions up to, and including, 3.3.1. This allows authenticated attackers, with subscriber-level capabilities or abo...

Medel 2023-07-12 CVE-2023-2517

CVE-2023-2517: The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.3.2. This is due to missing or incorrect nonce valida...

Påverkade versioner: < 3.3.3

The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.3.2. This is due to missing or incorrect nonce validation on the permalink_setup function. This makes it p...

Medel 2023-06-09 CVE-2023-1843

CVE-2023-1843: The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to unauthorized permalink structure update due to a missing capability check on the permalink_setup function in version...

Påverkade versioner: <= 3.3.0

The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to unauthorized permalink structure update due to a missing capability check on the permalink_setup function in versions up to, and including, 3.3.0. This makes it possible...

Hög 2023-06-09 CVE-2023-0721

CVE-2023-0721: The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to CSV injection in versions up to, and including, 3.3.0. This allows unauthenticated attackers to embed untrusted inpu...

Påverkade versioner: <= 3.3.0

The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to CSV injection in versions up to, and including, 3.3.0. This allows unauthenticated attackers to embed untrusted input into exported CSV files, which can result in code e...

Medel 2023-06-09 CVE-2023-0710

CVE-2023-0710: The Metform Elementor Contact Form Builder for WordPress is vulnerable to Cross-Site Scripting by using the 'fname' attribute of the 'mf_thankyou' shortcode to echo unescaped form submissions in ve...

Påverkade versioner: <= 3.3.0

The Metform Elementor Contact Form Builder for WordPress is vulnerable to Cross-Site Scripting by using the 'fname' attribute of the 'mf_thankyou' shortcode to echo unescaped form submissions in versions up to, and including, 3.3.0. This allows authe...

Medel 2023-06-09 CVE-2023-0709

CVE-2023-0709: The Metform Elementor Contact Form Builder for WordPress is vulnerable to Cross-Site Scripting by using the 'mf_last_name' shortcode to echo unescaped form submissions in versions up to, and includ...

Påverkade versioner: <= 3.3.0

The Metform Elementor Contact Form Builder for WordPress is vulnerable to Cross-Site Scripting by using the 'mf_last_name' shortcode to echo unescaped form submissions in versions up to, and including, 3.3.0. This allows authenticated attackers, with...

Medel 2023-06-09 CVE-2023-0708

CVE-2023-0708: The Metform Elementor Contact Form Builder for WordPress is vulnerable to Cross-Site Scripting by using the 'mf_first_name' shortcode to echo unescaped form submissions in versions up to, and inclu...

Påverkade versioner: <= 3.3.0

The Metform Elementor Contact Form Builder for WordPress is vulnerable to Cross-Site Scripting by using the 'mf_first_name' shortcode to echo unescaped form submissions in versions up to, and including, 3.3.0. This allows authenticated attackers, wit...

Medel 2023-06-09 CVE-2023-0695

CVE-2023-0695: The Metform Elementor Contact Form Builder for WordPress is vulnerable to Cross-Site Scripting by using the 'mf' shortcode to echo unescaped form submissions in versions up to, and including, 3.3.0...

Påverkade versioner: <= 3.3.0

The Metform Elementor Contact Form Builder for WordPress is vulnerable to Cross-Site Scripting by using the 'mf' shortcode to echo unescaped form submissions in versions up to, and including, 3.3.0. This allows authenticated attackers, with contribut...

Medel 2023-06-09 CVE-2023-0694

CVE-2023-0694: The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf' shortcode in versions up to, and including, 3.3.1. This allows authenticated attackers,...

Påverkade versioner: <= 3.3.1

The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf' shortcode in versions up to, and including, 3.3.1. This allows authenticated attackers, with subscriber-level capabilities or above to obtai...

Medel 2023-06-09 CVE-2023-0693

CVE-2023-0693: The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf_transaction_id' shortcode in versions up to, and including, 3.3.1. This allows authentic...

Påverkade versioner: <= 3.3.1

The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf_transaction_id' shortcode in versions up to, and including, 3.3.1. This allows authenticated attackers, with subscriber-level capabilities or...

Medel 2023-06-09 CVE-2023-0692

CVE-2023-0692: The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf_payment_status' shortcode in versions up to, and including, 3.3.1. This allows authentic...

Påverkade versioner: <= 3.3.1

The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf_payment_status' shortcode in versions up to, and including, 3.3.1. This allows authenticated attackers, with subscriber-level capabilities or...

Medel 2023-06-09 CVE-2023-0691

CVE-2023-0691: The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf_last_name' shortcode in versions up to, and including, 3.3.1. This allows authenticated ...

Påverkade versioner: <= 3.3.1

The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf_last_name' shortcode in versions up to, and including, 3.3.1. This allows authenticated attackers, with subscriber-level capabilities or abov...

Medel 2023-06-09 CVE-2023-0688

CVE-2023-0688: The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf_thankyou' shortcode in versions up to, and including, 3.3.1. This allows authenticated a...

Påverkade versioner: <= 3.3.1

The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf_thankyou' shortcode in versions up to, and including, 3.3.1. This allows authenticated attackers, with subscriber-level capabilities or above...

Medel 2023-03-02 CVE-2023-0084

CVE-2023-0084: The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via text areas on forms in versions up to, and including, 3.1.2 due to insufficient inpu...

Påverkade versioner: <= 3.1.2

The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via text areas on forms in versions up to, and including, 3.1.2 due to insufficient input sanitization and output escaping. This makes it pos...

Medel 2023-03-02 CVE-2023-0085

CVE-2023-0085: The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to reCaptcha Bypass in versions up to, and including, 3.2.1. This is due to insufficient server side checking on the ca...

Påverkade versioner: <= 3.2.1

The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to reCaptcha Bypass in versions up to, and including, 3.2.1. This is due to insufficient server side checking on the captcha value submitted during a form submission. This...

Hög 2022-05-10 CVE-2022-1442

CVE-2022-1442: The Metform WordPress plugin is vulnerable to sensitive information disclosure due to improper access control in the ~/core/forms/action.php file which can be exploited by an unauthenticated attack...

Påverkade versioner: < 2.1.4

The Metform WordPress plugin is vulnerable to sensitive information disclosure due to improper access control in the ~/core/forms/action.php file which can be exploited by an unauthenticated attacker to view all API keys and secrets of integrated thi...

Så skyddar du din sajt

Sårbarheter i tillägg är den vanligaste attackytan för WordPress-sajter. Det bästa skyddet är att vara proaktiv — här är tre konkreta steg.

Håll tillägget uppdaterat

De flesta sårbarheter i MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor åtgärdas snabbt av utvecklarna. Uppdatera alltid till senaste versionen.

Ta bort oanvända tillägg

Varje tillägg är en potentiell attackyta. Avinstallera det du inte aktivt använder.

Bevaka automatiskt

Med löpande övervakning upptäcker du problem innan de blir allvarliga.

Vill du slippa hålla koll själv? Med ett supportavtal från Sitesupport sköter vi uppdateringar och säkerhet åt dig.

Vanliga frågor om MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor

MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor har 27 kända sårbarheter, varav 4 med hög eller kritisk allvarlighetsgrad. Det betyder inte nödvändigtvis att tillägget är osäkert — de flesta sårbarheter åtgärdas i nya versioner. Det viktigaste är att alltid köra den senaste versionen.

Det enklaste sättet är att köra ett gratis test av din hemsida på sitesupport.co. Testet kontrollerar vilka tillägg du använder och vilka versioner som är installerade, och jämför det mot kända sårbarheter.

Uppdatera till den senaste versionen så snart som möjligt. Om det inte finns en uppdatering som åtgärdar problemet bör du överväga att tillfälligt inaktivera tillägget, särskilt om sårbarheten har kritisk eller hög allvarlighetsgrad.

MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor har över 600 000 aktiva installationer på WordPress.org och ett betyg på 4.7 av 5. Populära tillägg har generellt bättre säkerhetsrutiner tack vare större community och fler ögon på koden.