Live › vulnerability › CVE-2026-92098
Go to dashboardThe Multi-Step Forms for Contact Form 7 WordPress plugin does not sanitize the l10n_print_after parameter, so a crafted link injects script into the page. An unauthenticated attacker can run scripts in a visitor's browser if that visitor is tricked into clicking the link.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 07:31 UTC. All times on this page are UTC.
Sites running Multi-Step Forms for Contact Form 7 at version 4.7 or earlier that have at least one Contact Form 7 form configured with the [multistep] form-tag. Sites without a multistep form are not exposed per the description, and sites already on a version after 4.7 are covered by the fix.
No product ranges from the sources yet.
wp plugin get <plugin-slug> --field=version[multistep] form-tag, which the description says is required for exploitation4.7, the first version the sources say blocks the attack pathEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Webheadcoder Multi-Step Forms for Contact Form 7 plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'l10n_print_after' parameter in all versions up to, and including, 4.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Successful exploitation requires that the targeted site has at least one Contact Form 7 form configured with a [multistep] form-tag, as the canonicalization introduced in version 4.7 blocks the attack path on non-multistep forms.
This page as .md · .json · in your agent: get_signal("CVE-2026-92098")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.