Reflected Cross-Site Scripting in Webheadcoder Multi-Step Forms for Contact Form 7 Plugin

CVE-2026-92098

What is CVE-2026-92098?

The Webheadcoder Multi-Step Forms for Contact Form 7 plugin for WordPress is susceptible to a reflected cross-site scripting vulnerability. This issue arises from inadequate input sanitization and output escaping in the 'l10n_print_after' parameter across all versions up to and including 4.7. An attacker can exploit this vulnerability to inject arbitrary scripts into pages, potentially compromising user sessions or exposing sensitive information. The successful execution of this attack hinges on tricking users into clicking malicious links, specifically in setups where a Contact Form 7 multi-step form is implemented—non-multistep forms are not vulnerable due to the newly introduced canonicalization in version 4.7.

References