MetForm vulnerabilities | LiveThreat CVE Feed

Product

MetForm

by · last CVE Oct 7, 2026

CVEs

On KEV

5.4

Max CVSS

New 30D

Severity mix

Critical 0High 0Medium 3Low 1

Severity

Exploitation

Watch

Add MetForm to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2026-86833	5.4	0%	Oct 7	MetForm < 4.3.1 - Unauthenticated HTML Injection in Notification Emails via Field Shortcodes Affected: before 4.3.1
CVE-2026-86832	5.3	0%	Oct 3	MetForm < 4.3.1 - Unauthenticated Form Entry Data Disclosure via REST API Affected: before 4.3.1
CVE-2026-86813	4.8	0%	Sep 11	MetForm < 4.1.9 - Unauthenticated Email Header Injection via Notification Reply-To Affected: before 4.1.9