CF7-MULTI-STEP · CVE-2026-116753 · Package
FIX → 2.9.2
The Multi Step for Contact Form 7 WordPress plugin does not sanitize a multipart field name, so unauthenticated visitors can submit script that is stored and run in pages. An attacker gets script execution in the browser of anyone who opens an affected page, including site administrators.
first public Nov 14, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Sites running the Multi Step for Contact Form 7 plugin at version 2.9.1 or earlier are exposed only if the form has 'Save every step' enabled and the Database for Contact Form 7 companion plugin is active with its 'Expandable' table option on. Both settings are disabled by default, so sites using default configuration are not affected.
Not affected if default-config, plugin-not-installed, save-every-step-off
Who cares contact-form-7, self-hosted, wordpress
Multi Step for Contact Form 7 plugin is installed and its version is 2.9.1 or lower.Database for Contact Form 7 plugin is active with its 'Expandable' table option enabled.Upgrade to 2.9.2
The Multi Step for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'multipart field name (array key)' parameter in all versions up to, and including, 2.9.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires the target CF7 form to have the 'Save every step' option enabled and the Database for Contact Form 7 companion plugin to be active with its 'Expandable' table option enabled, both of which are disabled by default.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
2.9.2Security issues in step validationSave every step or the Database for Contact Form 7 Expandable table option