Stored Cross-Site Scripting Vulnerability in Multi Step for Contact Form 7 Plugin

CVE-2026-116753

What is CVE-2026-116753?

The Multi Step for Contact Form 7 plugin for WordPress is susceptible to a Stored Cross-Site Scripting vulnerability. The issue arises from the 'multipart field name (array key)' parameter, where insufficient input sanitization and output escaping allow unauthorized attackers to inject arbitrary scripts. When a user accesses an affected page, these scripts can execute without user consent. Successful exploitation necessitates the 'Save every step' feature being enabled on the target CF7 form in conjunction with the active 'Expandable' table option from the Database for Contact Form 7 plugin, both of which are typically disabled by default. Users are advised to review their plugin configurations to mitigate potential risks.

References