Webheadcoder Multi-Step Forms CVE-2026-92098

Exploitation requires that the target site has at least one Contact Form 7 form configured with a [multistep] form-tag - the description states the canonicalization introduced in 4.7 blocks the attack path on non-multistep forms, so sites without a multistep form are not exploitable. Because it is reflected XSS (not stored), the attacker must also get a victim to perform an action such as clicking a crafted link (UI:R), and the payload executes only in that victim's browser session with no persistence. On the positive side for attackers, no authentication is required (PR:N) and the attack is network-delivered (AV:N). Limiting factors for defenders: the required user interaction, the dependency on a multistep form being present, and the lack of any confirmed active exploitation or public exploit code.

This is a moderate-severity reflected XSS (CWE-79, CVSS 6.1) whose signals are internally consistent rather than conflicting. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N indicates a network-reachable, unauthenticated (PR:N) flaw that requires victim interaction (UI:R) and yields only limited confidentiality/integrity impact within the browser (scope-changed, C:L/I:L, A:N) - typical of reflected XSS, not server compromise. There is no KEV listing, so this is 'no public exploit identified at time of analysis' and there is no evidence of active exploitation; no EPSS score was supplied, so exploitation probability cannot be quantified from the input. The vuln.today Decision label is 'this_month' (not act_now/emergency), which aligns with the picture of a real-but-not-urgent issue: genuine, remotely triggerable, but gated by two practical factors - the victim must be tricked into clicking a crafted link, and the target site must have at least one Contact Form 7 form configured with a [multistep] form-tag, because the canonicalization added in 4.7 blocks the path on non-multistep forms. Net: a legitimate patch-this-cycle item for sites running multistep CF7 forms, not a drop-everything emergency, and not a high-CVSS-but-illusory issue either.

An unauthenticated attacker crafts a URL pointing at a page of the target WordPress site that renders a Contact Form 7 multistep form, embedding a script payload in the 'l10n_print_after' parameter, and lures a logged-in user or visitor into clicking it (e.g., via phishing). When the victim loads the page, the unsanitized parameter is reflected into the response and the injected script executes in the victim's browser in the site's origin. No public exploit code is identified at time of analysis, though the vendor fix commit and the vulnerable source lines are publicly visible.