Webheadcoder Multi Step Forms For Contact Form 7
Monthly
Reflected cross-site scripting in the Webheadcoder Multi-Step Forms for Contact Form 7 WordPress plugin, affecting all versions up to and including 4.7, lets unauthenticated remote attackers inject arbitrary script through the 'l10n_print_after' parameter, which is written into a page without adequate sanitization or escaping and executes in a victim's browser when a crafted link is visited. The site must have at least one Contact Form 7 form configured with a [multistep] form-tag, since the canonicalization added in 4.7 blocks the attack path on non-multistep forms, and successful exploitation depends on a user being tricked into clicking a link (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, 6.1). No confirmed active exploitation (CISA KEV) or public exploit code was identified at time of analysis; the upstream commit that removes the reserved 'l10n_print_after' key is public, and the plugin Trac shows a 4.7.1 tag.
Reflected cross-site scripting in the Webheadcoder Multi-Step Forms for Contact Form 7 WordPress plugin, affecting all versions up to and including 4.7, lets unauthenticated remote attackers inject arbitrary script through the 'l10n_print_after' parameter, which is written into a page without adequate sanitization or escaping and executes in a victim's browser when a crafted link is visited. The site must have at least one Contact Form 7 form configured with a [multistep] form-tag, since the canonicalization added in 4.7 blocks the attack path on non-multistep forms, and successful exploitation depends on a user being tricked into clicking a link (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, 6.1). No confirmed active exploitation (CISA KEV) or public exploit code was identified at time of analysis; the upstream commit that removes the reserved 'l10n_print_after' key is public, and the plugin Trac shows a 4.7.1 tag.