WordPress Webheadcoder Multi-Step Forms for Contact Form 7 plugin <= 4.7 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Fraudless in WordPress Plugin Contact Form 7 Multi-Step Forms versions = 4.7...

CVE-2026-92098

The Webheadcoder Multi-Step Forms for Contact Form 7 plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'l10nprintafter' parameter in all versions up to, and including, 4.7 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-92098 Webheadcoder Multi-Step Forms for Contact Form 7 <= 4.7 - Reflected Cross-Site Scripting via 'l10n_print_after' Parameter

The Webheadcoder Multi-Step Forms for Contact Form 7 plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'l10nprintafter' parameter in all versions up to, and including, 4.7 due to insufficient input sanitization and output escaping. This makes it possible for...

EUVD-2026-111755

The Webheadcoder Multi-Step Forms for Contact Form 7 plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'l10nprintafter' parameter in all versions up to, and including, 4.7 due to insufficient input sanitization and output escaping. This makes it possible for...

PT-2026-127894

The Webheadcoder Multi-Step Forms for Contact Form 7 plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'l10n print after' parameter in all versions up to, and including, 4.7 due to insufficient input sanitization and output escaping. This makes it possible for...