{"id":"CVE-2026-92098","kind":"vulnerability","aliases":["CVE-2026-92098"],"related":[],"title":"WordPress Multi-Step Forms for Contact Form 7: reflected XSS via l10n_print_after","description":"The Webheadcoder Multi-Step Forms for Contact Form 7 plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'l10n_print_after' parameter in all versions up to, and including, 4.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Successful exploitation requires that the targeted site has at least one Contact Form 7 form configured with a [multistep] form-tag, as the canonicalization introduced in version 4.7 blocks the attack path on non-multistep forms.","summary":"The Multi-Step Forms for Contact Form 7 WordPress plugin does not sanitize the l10n_print_after parameter, so a crafted link injects script into the page. An unauthenticated attacker can run scripts in a visitor's browser if that visitor is tricked into clicking the link.","severity":"medium","cvss":6.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["contact-form-7","package","self-hosted","wordpress"],"not_affected_if":["no-multistep-form","updated-past-4.7"],"how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or with `wp plugin get <plugin-slug> --field=version`\n- Check whether any Contact Form 7 form uses the `[multistep]` form-tag, which the description says is required for exploitation","fix":"- Update the Multi-Step Forms for Contact Form 7 plugin to a version later than `4.7`, the first version the sources say blocks the attack path\n- Until updated, the sources do not name a workaround","status":"open","published_at":"2026-10-28T07:16:49+00:00","first_seen_at":"2026-10-28T07:31:38+00:00","triaged_at":"2026-10-28T07:33:16+00:00","updated_at":"2026-10-28T07:33:16+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-28T07:33:16Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Multi-Step Forms for Contact Form 7 plugin to a version later than `4.7`, the first version the sources say blocks the attack path\n- Until updated, the sources do not name a workaround","reach":"internet","title":"WordPress Multi-Step Forms for Contact Form 7: reflected XSS via l10n_print_after","impact":"medium","summary":"The Multi-Step Forms for Contact Form 7 WordPress plugin does not sanitize the l10n_print_after parameter, so a crafted link injects script into the page. An unauthenticated attacker can run scripts in a visitor's browser if that visitor is tricked into clicking the link.","category":"package","nicknames":[],"who_cares":["wordpress","contact-form-7","self-hosted"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker runs scripts in a victim's browser on the affected site.","analyst_note":"","how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or with `wp plugin get <plugin-slug> --field=version`\n- Check whether any Contact Form 7 form uses the `[multistep]` form-tag, which the description says is required for exploitation","needs_analyst":false,"not_affected_if":["no-multistep-form","updated-past-4.7"],"who_is_affected":"Sites running Multi-Step Forms for Contact Form 7 at version 4.7 or earlier that have at least one Contact Form 7 form configured with the [multistep] form-tag. Sites without a multistep form are not exposed per the description, and sites already on a version after 4.7 are covered by the fix.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000649,"input_tokens":3467,"output_tokens":604,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':16A,19A '-92098':17A,20A '4.7':112C,182C '7':9A,24B,38B,87C,167C 'action':147C 'arbitrari':130C 'attack':60B,127C,185C 'block':183C 'browser':68B 'canonic':178C 'click':75B,150C 'configur':169C 'contact':7A,22B,36B,85C,165C 'contact-form':21B 'craft':51B 'cross':96C 'cross-sit':95C 'cve':15A,18A 'due':113C 'escap':120C 'execut':136C 'exploit':155C 'form':5A,8A,23B,34B,37B,83C,86C,166C,168C,174C,191C 'form-tag':173C 'host':28B 'includ':111C 'inject':53B,129C 'input':116C 'insuffici':115C 'introduc':179C 'l10n':13A,45B,101C 'least':163C 'link':52B,77B,153C 'make':122C 'multi':3A,32B,81C 'multi-step':2A,31B,80C 'multistep':172C,190C 'non':189C 'non-multistep':188C 'one':164C 'output':119C 'packag':25B 'page':57B,134C 'paramet':48B,104C 'path':186C 'perform':145C 'plugin':40B,88C 'possibl':124C 'print':14A,46B,102C 'reflect':10A,94C 'requir':156C 'run':62B 'sanit':43B,117C 'script':54B,63B,98C,132C 'self':27B 'self-host':26B 'site':97C,160C 'step':4A,33B,82C 'success':140C,154C 'tag':175C 'target':159C 'trick':73B,141C 'unauthent':59B,126C 'user':143C 'version':107C,181C 'via':12A,99C 'visitor':66B,71B 'vulner':92C 'web':131C 'webheadcod':79C 'wordpress':1A,29B,39B,90C 'xss':11A","nicknames":[],"mitigations":[],"who_affected":"Sites running Multi-Step Forms for Contact Form 7 at version 4.7 or earlier that have at least one Contact Form 7 form configured with the [multistep] form-tag. Sites without a multistep form are not exposed per the description, and sites already on a version after 4.7 are covered by the fix.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T07:16:49+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-92098","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92098","severity":null,"published_at":"2026-10-28T07:16:49+00:00","modified_at":"2026-10-28T07:16:49+00:00","first_seen_at":"2026-10-28T07:31:38+00:00","fetched_at":"2026-10-28T07:31:38+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}