Mohammed El Amin

**Name of the Vulnerable Software and Affected Versions** Metform Elementor Contact Form Builder plugin for WordPress versions up to, and including, 3.1.2 **Description** The issue is related to Stored Cross-Site Scripting via text areas on forms due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page, specifically the submissions page. **Recommendations** For versions up to, and including, 3.1.2, update to a version higher than 3.1.2 to resolve the issue. As a temporary workaround, consider restricting access to the submissions page to minimize the risk of exploitation. Additionally, ensure proper input sanitization and output escaping for all text areas on forms to prevent arbitrary web script injection.

**Name of the Vulnerable Software and Affected Versions** Metform Elementor Contact Form Builder plugin for WordPress versions up to, and including, 3.2.1 **Description** The issue is related to insufficient server-side checking of the captcha value submitted during form submission, allowing unauthenticated attackers to bypass Captcha restrictions. This enables attackers to utilize bots to submit forms. **Recommendations** For versions up to, and including, 3.2.1, update to a version higher than 3.2.1 to resolve the issue.