Is CVE-2026-18100 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-18100 being exploited in the wild.

How severe is CVE-2026-18100?

Medium severity, with a CVSS score of 6.4, published 25 August 2026.

Is there a fix for CVE-2026-18100?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-18100 attacked?

It is attacked over the network.

Am I affected by CVE-2026-18100?

Check whether you run Elementor MetForm at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-18100: MetForm stored cross-site scripting in form widget

CVE-2026-18100 · Severity: medium · CVSS 6.4 · Published 2026-08-25

MetForm is a WordPress plugin for building contact forms, surveys, and quizzes within the Elementor page builder. Authenticated users with contributor-level access can inject malicious JavaScript code into form widget settings that executes when other users view the affected page, potentially enabling account takeover, data theft, or malware delivery.

Vendors: Elementor.

Quick answers

Is CVE-2026-18100 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-18100 being exploited in the wild.
How severe is CVE-2026-18100?: Medium severity, with a CVSS score of 6.4, published 25 August 2026.
Which products and versions are affected?: Elementor MetForm up to 4.1.8.
Is there a fix for CVE-2026-18100?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-18100 attacked?: It is attacked over the network.
Am I affected by CVE-2026-18100?: Check whether you run Elementor MetForm at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a stored cross-site scripting (XSS) flaw in the 'mf_form_id' widget setting affecting MetForm versions up to 4.1.8. The root cause is insufficient input sanitization and output escaping in the plugin's form picker component. The attack requires authentication with contributor-level or higher privileges and occurs at page-load time when an attacker-controlled form ID is processed. The payload bypasses Elementor's wp_kses_post filter (which strips HTML tags) by containing no HTML, and exploits MetForm's str_replace transformation that converts script tags into JavaScript template literals, providing an additional injection vector. Patches are available in versions after 4.1.8.

Affected products

Elementor MetForm up to 4.1.8

Timeline

2026-08-25: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.