---
id: "CVE-2026-116753"
page: "https://infrastack.ai/live/CVE-2026-116753"
kind: "vulnerability"
aliases: ["CVE-2026-116753"]
title: "WordPress Multi Step for Contact Form 7: stored XSS via form field names"
severity: "high"
cvss: 7.2
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "cf7-multi-step", "fixed": ["2.9.2"], "affected": "<= 2.9.1", "ecosystem": "wordpress"}]
ecosystems: []
tags: ["contact-form-7", "package", "self-hosted", "wordpress"]
not_affected_if: ["default-config", "plugin-not-installed", "save-every-step-off"]
published_at: "2026-11-14T16:17:03+00:00"
first_seen_at: "2026-11-14T16:30:58+00:00"
updated_at: "2026-11-14T16:32:38+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116753", "first_seen_at": "2026-11-14T16:30:58+00:00"}, {"source": "analyst", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116753", "first_seen_at": "2026-11-14T16:32:38+00:00", "cites": ["https://nvd.nist.gov/vuln/detail/CVE-2026-116753", "https://wordpress.org/plugins/cf7-multi-step/"]}]
exploit_sources: []
---

# WordPress Multi Step for Contact Form 7: stored XSS via form field names

Link for people: https://infrastack.ai/live/CVE-2026-116753 (this .md is for agents)

The Multi Step for Contact Form 7 WordPress plugin does not sanitize a multipart field name, so unauthenticated visitors can submit script that is stored and run in pages. An attacker gets script execution in the browser of anyone who opens an affected page, including site administrators.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress:cf7-multi-step affected <= 2.9.1 fixed 2.9.2

## How to check

- Check whether the `Multi Step for Contact Form 7` plugin is installed and its version is `2.9.1` or lower.
- In the CF7 form settings, check whether the 'Save every step' option is enabled.
- Check whether the `Database for Contact Form 7` plugin is active with its 'Expandable' table option enabled.

## Fix

Update Multi Step for Contact Form 7 to 2.9.2 or later (WordPress.org changelog: 'Security issues in step validation'; the page does not name this CVE). Until then, turn off 'Save every step' or the Database for Contact Form 7 'Expandable' table option.

## Timeline

- 2026-11-14T16:30:58+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116753
- 2026-11-14T16:32:38+00:00 analyst https://nvd.nist.gov/vuln/detail/CVE-2026-116753 — NVD: <=2.9.1 affected. WordPress.org changelog lists 2.9.2 (Nov 12, 2026) 'Fixed: Security issues in step validation' without naming the CVE, so fix version is likely but not confirmed; not verified. No PoC or exploitation seen.

## Documents

- [advisory] NVD CVE-2026-116753 https://nvd.nist.gov/vuln/detail/CVE-2026-116753
- [fix] Multi Step for Contact Form 7 – WordPress.org (changelog) https://wordpress.org/plugins/cf7-multi-step/

## From the sources

The Multi Step for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'multipart field name (array key)' parameter in all versions up to, and including, 2.9.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires the target CF7 form to have the 'Save every step' option enabled and the Database for Contact Form 7 companion plugin to be active with its 'Expandable' table option enabled, both of which are disabled by default.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_