CVE-2026-18100

Executive Summary

CVE-2026-18100 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor plugin for WordPress, in all versions up to and including 4.1.8. The vulnerability resides in the 'mf_form_id' widget setting and allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts that execute whenever a user accesses an affected page. The flaw is notable for its ability to bypass Elementor's save-time wp_kses_post filter — the payload contains no HTML tags — and leverages MetForm's own script-tag transformation logic as an additional delivery path. With no patch currently available, all installations running MetForm 4.1.8 or earlier are exposed to this attack vector.

Technical Analysis

Vulnerability Class: Stored Cross-Site Scripting (XSS) — CWE-79

Affected Component: The mf_form_id widget setting within the MetForm plugin for WordPress.

Root Cause: The plugin fails to apply sufficient input sanitization and output escaping on the mf_form_id widget setting. This permits authenticated attackers with at least contributor-level privileges to embed malicious script content within this setting, which is subsequently rendered unsafely when the page is accessed by other users.

Key Technical Details from the NVD Description:

1. Bypass of Elementor's wp_kses_post Filter: The standard WordPress/Elementor save-time filtering mechanism (wp_kses_post) strips dangerous HTML tags from content. The attacker's payload bypasses this sanitization because it contains no HTML tags — the malicious payload is structured entirely without tag delimiters, allowing it to pass through the filter intact.

2. MetForm's str_replace Transformation: MetForm's own backend logic performs a str_replace operation that transforms script tags into JavaScript template literal expressions. This transformation is dual-purpose: while presumably intended for legitimate functionality or output encoding, it provides an additional delivery path for the attacker's payload. Because the malicious content is reformatted via this transformation into a template literal expression, it may evade additional regex-based or signature-based filters that look for traditional <script> patterns.

3. Execution Context: The injected script executes in the context of the victim's browser session, inheriting the privileges of the viewing user. When an administrator or editor accesses a page containing the malicious mf_form_id setting, the script executes with those elevated context permissions.

Attack Surface: The attack surface is any WordPress site running MetForm with at least one user having contributor-level access or above. This is a low-barrier entry point given that WordPress sites commonly delegate content creation to multiple contributors. The vulnerability does not require any network-level exploitation — it is entirely application-layer.

Affected Versions: All MetForm versions up to and including 4.1.8. No earlier version cutoff is provided in the available data.

Exploitation Scenarios

Note: No public PoC is available; the attack chain below is inferred from the vulnerability class and NVD description.

Step 1 — Reconnaissance & Target Identification: An attacker first identifies WordPress sites running the MetForm plugin. This can be accomplished via:

• Shodan/Censys queries targeting WordPress and Elementor headers
• WordPress scan tools (WPScan, etc.) that fingerprint plugin versions
• Observing the site's source HTML for MetForm-specific CSS/JS identifiers
• Identifying a WordPress user account with contributor-level privileges (either through compromised credentials, social engineering, or legitimate access)

Step 2 — Flaw Trigger: The attacker authenticates to the WordPress admin dashboard with a contributor-level account. They navigate to a page or post editing interface and access the MetForm widget settings, specifically the mf_form_id field. This setting is saved as part of the page metadata.

Step 3 — Payload Execution Method (Vulnerability Class Level): Given insufficient input sanitization and output escaping, the attacker injects a malicious payload into the mf_form_id widget setting. The payload is crafted to:

• Contain no HTML tags (to bypass wp_kses_post during save-time filtering)
• Exploit MetForm's str_replace transformation of script tags into JavaScript template literal expressions as a delivery mechanism

The payload, at the class level, would be a script that executes in the browser context — for example, JavaScript that:

• Captures session cookies or authentication tokens
• Redirects users to phishing pages
• Performs CSRF-like actions on behalf of the victim
• Defaces the page content

Step 4 — Post-Exploitation Impact: When any user (including site administrators) views the affected page, the injected script executes. The impact scales with the privilege level of the victim:

• Administrator victim: Full site compromise — the script can create new admin accounts, install backdoor plugins, inject additional malicious content site-wide, or exfiltrate the entire user database
• Editor/Author victim: Content manipulation or staged privilege escalation
• Anonymous visitor victim: Defacement visible to site visitors, credential phishing, or malware distribution

The stored nature of this XSS makes it self-propagating in the sense that any page containing the malicious setting becomes a persistent delivery vector until manually cleaned.

Impact Assessment

CVSS Score: 6.4 (Medium) — Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Scoring Rationale:

• Attack Vector (AV:N — Network): The vulnerability is exploitable remotely through the web interface.
• Attack Complexity (AC:L — Low): No special conditions are required; the attack is straightforward.
• Privileges Required (PR:L — Low): Contributor-level access is a low-privilege bar in WordPress.
• User Interaction (UI:N — None): The attacker does not need to interact with the victim; the stored script executes when the victim merely views the page.
• Scope (S:C — Changed): The vulnerable component (MetForm widget setting) impacts a different security context (the victim's browser session and broader WordPress environment).
• Confidentiality (C:L — Low): Potential for data theft (session tokens, page content).
• Integrity (I:L — Low): Potential for content manipulation and script injection.
• Availability (A:N — None): No direct availability impact.

Business Impact:

• Affected Systems: All WordPress sites using MetForm versions ≤ 4.1.8 with Elementor.

  • Blast Radius: Any page containing a MetForm form widget is potentially affected. In a typical WordPress installation, this could include contact pages, landing pages, and marketing sites.
  • Supply Chain Risk: The plugin is distributed via the WordPress plugin repository; there is no indication of a compromised update channel, but the vulnerable versions are widely deployed.

Real-World Severity Assessment: While the CVSS score of 6.4 falls in the Medium range, the practical risk is elevated by:

• The absence of any patch (0/4 confidence)
• The low privilege requirement (contributor-level)
• The stored, persistent nature of the payload
• The bypass of standard sanitization defenses, making this harder to detect at the WordPress save layer

Detection Guidance

Sigma Rule

title: MetForm Stored XSS via mf_form_id Widget Setting
id: 8f3b6e2a-9c41-4e7b-8a24-0d5e1f3b7a92
status: experimental
description: Detects stored XSS payload patterns in MetForm mf_form_id widget settings, targeting CVE-2026-18100
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-18100
author: Valtersit Threat Intelligence
date: 2026/01/15
logsource:
    category: webserver
    product: wordpress
detection:
    selection_method:
        http.method: POST
        http.url|contains:
            - 'admin-ajax.php'
            - 'wp-admin/post.php'
        http.body|contains:
            - 'mf_form_id'
    selection_payload:
        http.body|contains|all:
            - '\\x60'
            - '\\x24\\x7b'
            - 'eval('
            - 'document.cookie'
            - 'fromCharCode'
    selection_anomaly:
        http.body|contains|all:
            - 'mf_form_id'
            - 'script'
    condition: selection_method and (selection_payload or selection_anomaly)
    level: high

YARA Rule

rule MetForm_Stored_XSS_mf_form_id_CVE_2026_18100 {
    meta:
        description = "Detects malicious payloads targeting MetForm mf_form_id widget setting (CVE-2026-18100)"
        author = "Valtersit Threat Intelligence"
        date = "2026-01-15"
        cve = "CVE-2026-18100"
        severity = "high"
    strings:
        $a = "mf_form_id" ascii wide nocase
        $b = "eval(" ascii wide
        $c = "document.cookie" ascii wide
        $d = "fromCharCode" ascii wide
        $e = "window.location" ascii wide
        $f = "fetch('" ascii wide
        $g = "XMLHttpRequest" ascii wide
        $h = "outerHTML" ascii wide
        $i = "innerHTML" ascii wide
    condition:
        uint16(0) == 0x3C3F or uint16(0) == 0x3C21 or uint16(0) == 0x3C73
        and $a
        and 2 of ($b, $c, $d, $e, $f, $g, $h, $i)
        and filesize < 2MB
}

Suricata IDS Rule

alert http any any -> any any (
    msg:"ET WEB_SPECIFIC_APPS MetForm mf_form_id Stored XSS Payload (CVE-2026-18100)";
    flow:established,to_server;
    content:"mf_form_id";
    http_client_body;
    content:"eval";
    http_client_body;
    distance:0;
    content:"document.cookie";
    http_client_body;
    distance:0;
    classtype:web-application-attack;
    sid:202618100;
    rev:1;
    metadata:created_at 2026_01_15, updated_at 2026_01_15, cve CVE-2026-18100;
)

Elastic Detection

// Elastic EQL query to detect MetForm XSS exploitation attempts
// Target: web server access logs or application traces (HTTP layer)

sequence by source.ip
  [ network where http.request.method == "POST" and
    http.request.body.content contains "mf_form_id" and
    (http.request.body.content contains "eval(" or
     http.request.body.content contains "document.cookie" or
     http.request.body.content contains "fromCharCode")
  ]
  [ any where http.response.status_code == 200 ]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=apache_access
| search uri_path IN ("/wp-admin/post.php", "/wp-admin/admin-ajax.php")
    AND form_data="*mf_form_id*"
    AND (form_data="*eval*" OR form_data="*document.cookie*" OR form_data="*fromCharCode*" OR form_data="*window.location*")
| eval attack_type = "CVE-2026-18100 MetForm Stored XSS"
| table _time, src_ip, uri_path, form_data, clientip, useragent
| sort - _time

Wazuh OSSEC Rule

<group name="wordpress,">
  <rule id="100301" level="12">
    <decoded_as>json</decoded_as>
    <field name="url">\.php</field>
    <field name="url">wp-admin|admin-ajax</field>
    <regex>mf_form_id</regex>
    <regex>eval\(|document\.cookie|fromCharCode|window\.location</regex>
    <description>MetForm Stored XSS payload detected in form_id setting (CVE-2026-18100)</description>
    <group>web_application_attack,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Status: UNPATCHED — Patch confidence is 0/4, with no evidence from any tracked source that a fix exists. As of this report, no patched version of MetForm has been identified.

1. Immediate Mitigations

• Restrict contributor-level access: Audit all user accounts with contributor-level access or above. Revoke accounts that are not actively needed. Reduce the number of users with this privilege tier.
• Web Application Firewall (WAF) rules: Deploy WAF rules to inspect POST requests to wp-admin/post.php and wp-admin/admin-ajax.php for mf_form_id fields containing JavaScript/script-like content patterns (eval, document.cookie, fromCharCode, etc.).
• Content Security Policy (CSP): Implement a strict CSP header that disallows inline script execution. This provides a browser-level mitigation even if XSS payloads are served.
• Monitor admin activity: Enable WordPress audit logging to track changes to page/post content, especially modifications to MetForm widget settings.
• Temporary isolation: If the affected pages are not business-critical, consider removing MetForm forms from public-facing pages until a patch is released.

2. Patch/Upgrade Steps

• Check for updates daily: Monitor the WordPress plugin repository for a MetForm release addressing CVE-2026-18100 (expected version > 4.1.8).
• Subscribe to vendor advisories: Register for security alert notifications from the plugin developer (Metheme) and the WordPress plugin security mailing list.
• Upon patch release: Apply the update immediately, then verify page integrity and re-scan all pages containing MetForm forms for residual malicious content.
• Manual content audit (pre-patch or post-patch): Review all pages and posts where the mf_form_id setting has been modified since the site was installed. Look for unexpected values, unusual formatting, or JavaScript-like content. Remove any suspicious entries.

3. Long-Term Hardening

• Least privilege enforcement: Implement a policy where only administrators can create or modify form widgets and related plugin settings.
• WordPress security baseline:
  • Keep all plugins, themes, and the WordPress core updated.
  • Enable automatic updates for plugins where possible.
  • Conduct periodic security audits of user roles and permissions.
  • Implement a WordPress security plugin that adds additional input sanitization layers.
• Defense in depth:
  • Use a web application firewall with virtual patching capabilities.
  • Deploy server-side malware scanning (e.g., Wordfence CLI, Imunify360).
  • Implement file integrity monitoring on the WordPress installation directory.
• Incident response preparation: Ensure logs are retained and accessible for forensic analysis. Document the detection queries above for use in future incidents.
• Vendor engagement: If MetForm is critical to your operations, directly contact the vendor to request a security patch timeline and express the urgency of the fix.

References

1. NVD Entry: CVE-2026-18100 — National Vulnerability Database

   • Source for CVSS vector, NVD description, and CWE mapping.

2. WordPress Plugin Repository: MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor

   • Official plugin page for monitoring version releases and patches.

3. CWE-79 Description: MITRE CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

   • Reference for the vulnerability class mechanics.

4. CISA Known Exploited Vulnerabilities Catalog: CISA KEV

   • CVE-2026-18100 is NOT listed; monitor this catalog for updates.

5. OWASP XSS Prevention Cheat Sheet: OWASP Cross-Site Scripting Prevention

   • Reference for defensive controls and sanitization best practices.

Report Metadata:

• Report ID: VLT-CVE-2026-18100-001
• Classification: TLP:GREEN
• Date of Preparation: 2026-01-15T00:00:00Z
• Threat Actor Attribution: No known threat actor campaigns associated with this CVE at the time of writing. No exploit-in-the-wild evidence has been confirmed.

Disclaimer: This report is based on the technical data provided in the NVD description and CVE metadata. Insufficient vendor-specific technical detail was available to describe internal implementation specifics; this report documents the vulnerability at the class level and the general attack mechanism as described. Specific function names, file paths, and implementation details not present in the NVD description have been deliberately omitted to prevent the introduction of inaccurate information.