webheadllc Webheadcoder Multi-Step Forms for Contact Form 7 vulnerabilities

Latest webheadllc Webheadcoder Multi-Step Forms for Contact Form 7 CVEs

Newest publication first

1. CVE-2026-92098 Webheadcoder Multi-Step Forms for Contact Form 7 <= 4.7 - Reflected Cross-Site Scripting via 'l10n_print_after' Parameter

   Published 2026-10-28

   Medium·CVSS 6.1 EPSS 0.22%

   The Webheadcoder Multi-Step Forms for Contact Form 7 plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'l10n_print_after' parameter in all versions up to, and including, 4.7 due to insufficient input sanitization and output escaping. This makes it possi...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.