Multi Step for Contact Form 7 <= 2.9.1 — Unauthenticated Stored Cross-Site Scripting via Multipart Field Name
CVE-2026-116753Published · Updated Action summary
Affected: ≤2.9.1Update to 2.9.2 or newer
All remediation steps10K+ active installs
Watch pluginOn this page3
Overview
- Advisory ID
- CVE-2026-116753
- Product
- Multi Step for Contact Form 7 cf7-multi-step
- Affected
- ≤2.9.1
- Fixed in
- 2.9.2
- Weakness
- CWE-79 Cross-Site Scripting
- Required access
- No account needed
- Published
- Credit
- R3D
- Source
- Wordfence Intelligence
- Affected≤ 2.9.1
- Patched in2.9.2
- Latest2.9.2
Update to 2.9.2 or newer.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:NWhat does this vector mean?
AV:NAttack vector- Network
AC:LAttack complexity- Low
PR:NPrivileges required- None
UI:NUser interaction- None
S:CScope- Changed
C:LConfidentiality- Low
I:LIntegrity- Low
A:NAvailability- None
The Multi Step for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'multipart field name (array key)' parameter in all versions up to, and including, 2.9.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires the target CF7 form to have the 'Save every step' option enabled and the Database for Contact Form 7 companion plugin to be active with its 'Expandable' table option enabled, both of which are disabled by default.
Not sure which version you run? Run a passive check — it reads public files only.
Remediation & mitigations
- Update to version 2.9.2, or a newer patched version
- Rotate administrator passwords and application secrets if the site ran a vulnerable version while publicly reachable.
References & provenance
Proof-of-concept & detection
No public proof-of-concept or detection template is known for this vulnerability.
Advisories & patches
- Advisorywordfence.com
Related CVEs
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| High7.5 | Unauthenticated SQL Injection ≤2.7.7Update to 2.7.8 | CVE-2024-47331 |
- High7.5Unauthenticated SQL Injection
≤2.7.7Update to 2.7.8
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| High7.2 | Unauthenticated Stored DOM-Based Cross-Site Scripting via Image Alt Attribute in .wp-caption Containers | CVE-2026-120687 | |
| Medium6.4 | Authenticated (Subscriber+) Stored Cross-Site Scripting via 'Popup' Shortcode Attribute via Profile Video | CVE-2026-110531 | |
| Medium5.4 | Unauthenticated Stored Cross-Site Scripting via 'title' Attribute of [bf_login_form] Shortcode | CVE-2026-127115 | |
| Critical9.8 | 1.8.0 - Authentication Bypass to Administrator | CVE-2026-19907 |
- High7.2Unauthenticated Stored DOM-Based Cross-Site Scripting via Image Alt Attribute in .wp-caption Containers
Lightbox & Modal Popup WordPress Plugin – FooBox
≤2.8.7Update to 2.8.8
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'Popup' Shortcode Attribute via Profile Video
FV Player 8
≤8.1.9Update to 8.2.0
- Medium5.4Unauthenticated Stored Cross-Site Scripting via 'title' Attribute of [bf_login_form] Shortcode
BuddyForms
≤2.10.6Update to 2.10.7
- Critical9.81.8.0 - Authentication Bypass to Administrator
Shipo
1.6 – 1.8.0Update to 1.8.1
Timeline
CVE published
Severity high, CVSS 7.2
Record last updated
Sources & licenses
Wordfence record- Vulnerability data
- Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Licensed under the CC BY-SA 4.0.
- CVE® identifiers
- Copyright 1999-2026 The MITRE Corporation. Used under the CVE Program. CVE® is a registered trademark of The MITRE Corporation.
- CVSS / CWE
- National Vulnerability Database (NVD), shown unmodified. This product uses the NVD API but is not endorsed or certified by the NVD.
- VulnCrest content
- Summary, remediation guidance and page layout © VulnCrest. Not sourced from NVD.