---
id: "CVE-2026-92098"
kind: "vulnerability"
aliases: ["CVE-2026-92098"]
title: "WordPress Multi-Step Forms for Contact Form 7: reflected XSS via l10n_print_after"
severity: "medium"
cvss: 6.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["contact-form-7", "package", "self-hosted", "wordpress"]
not_affected_if: ["no-multistep-form", "updated-past-4.7"]
published_at: "2026-10-28T07:16:49+00:00"
first_seen_at: "2026-10-28T07:31:38+00:00"
updated_at: "2026-10-28T07:33:16+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92098", "first_seen_at": "2026-10-28T07:31:38+00:00"}]
---

# WordPress Multi-Step Forms for Contact Form 7: reflected XSS via l10n_print_after

The Multi-Step Forms for Contact Form 7 WordPress plugin does not sanitize the l10n_print_after parameter, so a crafted link injects script into the page. An unauthenticated attacker can run scripts in a visitor's browser if that visitor is tricked into clicking the link.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed plugin version in the WordPress admin under Plugins, or with `wp plugin get <plugin-slug> --field=version`
- Check whether any Contact Form 7 form uses the `[multistep]` form-tag, which the description says is required for exploitation

## Fix

- Update the Multi-Step Forms for Contact Form 7 plugin to a version later than `4.7`, the first version the sources say blocks the attack path
- Until updated, the sources do not name a workaround

## Timeline

- 2026-10-28T07:31:38+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-92098

## From the sources

The Webheadcoder Multi-Step Forms for Contact Form 7 plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'l10n_print_after' parameter in all versions up to, and including, 4.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Successful exploitation requires that the targeted site has at least one Contact Form 7 form configured with a [multistep] form-tag, as the canonicalization introduced in version 4.7 blocks the attack path on non-multistep forms.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_