{"id":"CVE-2026-116753","kind":"vulnerability","aliases":["CVE-2026-116753"],"related":[],"title":"WordPress Multi Step for Contact Form 7: stored XSS via form field names","description":"The Multi Step for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'multipart field name (array key)' parameter in all versions up to, and including, 2.9.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires the target CF7 form to have the 'Save every step' option enabled and the Database for Contact Form 7 companion plugin to be active with its 'Expandable' table option enabled, both of which are disabled by default.","summary":"The Multi Step for Contact Form 7 WordPress plugin does not sanitize a multipart field name, so unauthenticated visitors can submit script that is stored and run in pages. An attacker gets script execution in the browser of anyone who opens an affected page, including site administrators.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"cf7-multi-step","fixed":["2.9.2"],"affected":"<= 2.9.1","ecosystem":"wordpress"}],"ecosystems":[],"tags":["contact-form-7","package","self-hosted","wordpress"],"not_affected_if":["default-config","plugin-not-installed","save-every-step-off"],"how_to_check":"- Check whether the `Multi Step for Contact Form 7` plugin is installed and its version is `2.9.1` or lower.\n- In the CF7 form settings, check whether the 'Save every step' option is enabled.\n- Check whether the `Database for Contact Form 7` plugin is active with its 'Expandable' table option enabled.","fix":"Update Multi Step for Contact Form 7 to 2.9.2 or later (WordPress.org changelog: 'Security issues in step validation'; the page does not name this CVE). Until then, turn off 'Save every step' or the Database for Contact Form 7 'Expandable' table option.","status":"open","published_at":"2026-11-14T16:17:03+00:00","first_seen_at":"2026-11-14T16:30:58+00:00","triaged_at":"2026-11-14T16:31:30+00:00","updated_at":"2026-11-14T16:32:38+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-14T16:31:30Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WordPress Multi Step for Contact Form 7: stored XSS via form field names","impact":"medium","summary":"The Multi Step for Contact Form 7 WordPress plugin does not sanitize a multipart field name, so unauthenticated visitors can submit script that is stored and run in pages. An attacker gets script execution in the browser of anyone who opens an affected page, including site administrators.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","contact-form-7","self-hosted"],"confidence":0.8,"fix_status":"unknown","needs_auth":"no","worst_case":"attacker runs scripts in visitors' and admins' browsers","analyst_note":"Confirm the fixed version from the WordPress.org plugin page or NVD; the sources give no fixed version.","how_to_check":"- Check whether the `Multi Step for Contact Form 7` plugin is installed and its version is `2.9.1` or lower.\n- In the CF7 form settings, check whether the 'Save every step' option is enabled.\n- Check whether the `Database for Contact Form 7` plugin is active with its 'Expandable' table option enabled.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["default-config","plugin-not-installed","save-every-step-off"],"who_is_affected":"Sites running the Multi Step for Contact Form 7 plugin at version 2.9.1 or earlier are exposed only if the form has 'Save every step' enabled and the Database for Contact Form 7 companion plugin is active with its 'Expandable' table option on. Both settings are disabled by default, so sites using default configuration are not affected.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000786,"input_tokens":4679,"output_tokens":636,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed version from the WordPress.org plugin page or NVD; the sources give no fixed version.","search":"'-116753':16A,19A '-2026':15A,18A '2.9.1':113C '7':7A,27B,39B,86C,167C 'access':142C 'activ':172C 'administr':79B 'affect':75B 'anyon':71B 'arbitrari':131C 'array':103C 'attack':63B,128C 'browser':69B 'cf7':21A,151C 'cf7-multi-step':20A 'companion':168C 'contact':5A,25B,37B,84C,165C 'contact-form':24B 'cross':95C 'cross-sit':94C 'cve':14A,17A 'databas':163C 'default':185C 'disabl':183C 'due':114C 'enabl':160C,178C 'escap':121C 'everi':157C 'execut':66B,138C 'expand':175C 'exploit':147C 'field':12A,47B,101C 'form':6A,11A,26B,38B,85C,152C,166C 'get':64B 'host':31B 'includ':77B,112C 'inject':130C,144C 'input':117C 'insuffici':116C 'key':104C 'make':123C 'multi':2A,22A,34B,81C 'multipart':46B,100C 'name':13A,48B,102C 'open':73B 'option':159C,177C 'output':120C 'packag':28B 'page':61B,76B,135C,145C 'paramet':105C 'plugin':41B,87C,169C 'possibl':125C 'requir':148C 'run':59B 'sanit':44B,118C 'save':156C 'script':54B,65B,97C,133C 'self':30B 'self-host':29B 'site':78B,96C 'step':3A,23A,35B,82C,158C 'store':8A,57B,93C 'submit':53B 'success':146C 'tabl':176C 'target':150C 'unauthent':50B,127C 'user':141C 'version':108C 'via':10A,98C 'visitor':51B 'vulner':91C 'web':132C 'whenev':139C 'wordpress':1A,32B,40B,89C 'xss':9A","nicknames":[],"mitigations":[],"who_affected":"Sites running the Multi Step for Contact Form 7 plugin at version 2.9.1 or earlier are exposed only if the form has 'Save every step' enabled and the Database for Contact Form 7 companion plugin is active with its 'Expandable' table option on. Both settings are disabled by default, so sites using default configuration are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["cf7multistep"],"ptokens":["cf7","multi","step"],"labels":["contactform7","high","package","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-116753':16A,19A '-2026':15A,18A '7':7A 'cf7':21A 'cf7-multi-step':20A 'contact':5A 'cve':14A,17A 'field':12A 'form':6A,11A 'multi':2A,22A 'name':13A 'step':3A,23A 'store':8A 'via':10A 'wordpress':1A 'xss':9A","search_b":"'7':27B,39B 'administr':79B 'affect':75B 'anyon':71B 'attack':63B 'browser':69B 'contact':25B,37B 'contact-form':24B 'execut':66B 'field':47B 'form':26B,38B 'get':64B 'host':31B 'includ':77B 'multi':34B 'multipart':46B 'name':48B 'open':73B 'packag':28B 'page':61B,76B 'plugin':41B 'run':59B 'sanit':44B 'script':54B,65B 'self':30B 'self-host':29B 'site':78B 'step':35B 'store':57B 'submit':53B 'unauthent':50B 'visitor':51B 'wordpress':32B,40B","search_c":"'2.9.1':113C '7':86C,167C 'access':142C 'activ':172C 'arbitrari':131C 'array':103C 'attack':128C 'cf7':151C 'companion':168C 'contact':84C,165C 'cross':95C 'cross-sit':94C 'databas':163C 'default':185C 'disabl':183C 'due':114C 'enabl':160C,178C 'escap':121C 'everi':157C 'execut':138C 'expand':175C 'exploit':147C 'field':101C 'form':85C,152C,166C 'includ':112C 'inject':130C,144C 'input':117C 'insuffici':116C 'key':104C 'make':123C 'multi':81C 'multipart':100C 'name':102C 'option':159C,177C 'output':120C 'page':135C,145C 'paramet':105C 'plugin':87C,169C 'possibl':125C 'requir':148C 'sanit':118C 'save':156C 'script':97C,133C 'site':96C 'step':82C,158C 'store':93C 'success':146C 'tabl':176C 'target':150C 'unauthent':127C 'user':141C 'version':108C 'via':98C 'vulner':91C 'web':132C 'whenev':139C 'wordpress':89C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-14T16:17:03+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116753","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116753","severity":null,"published_at":"2026-11-14T16:17:03+00:00","modified_at":"2026-11-14T16:17:03+00:00","first_seen_at":"2026-11-14T16:30:58+00:00","fetched_at":"2026-11-14T16:30:58+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-116753:3993","url":"https://wordpress.org/plugins/cf7-multi-step/","severity":null,"published_at":"2026-11-14T16:32:38+00:00","modified_at":"2026-11-14T16:32:38+00:00","first_seen_at":"2026-11-14T16:32:38+00:00","fetched_at":"2026-11-14T16:32:38+00:00","note":"NVD: <=2.9.1 affected. WordPress.org changelog lists 2.9.2 (Nov 12, 2026) 'Fixed: Security issues in step validation' without naming the CVE, so fix version is likely but not confirmed; not verified. No PoC or exploitation seen.","cites":["https://wordpress.org/plugins/cf7-multi-step/","https://nvd.nist.gov/vuln/detail/CVE-2026-116753"]}],"documents":[{"id":156907,"url":"https://wordpress.org/plugins/cf7-multi-step/","title":"Multi Step for Contact Form 7 – WordPress.org (changelog)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":156908,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116753","title":"NVD CVE-2026-116753","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}