Webheadcoder Multi-Step Forms for Contact Form 7 <= 4.7 - Reflected Cross-Site Scripting via 'l10n_print_after' Parameter

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-92098 · Microsoft / collected KEV context

cve-program · CVE-2026-92098

• https://www.wordfence.com/threat-intel/vulnerabilities/id/6fa810af-e620-49e5-9be0-f9fc4d09ed6d?source=cve
• https://plugins.trac.wordpress.org/browser/contact-form-7-multi-step-module/tags/4.7/cf7msm.php#L180
• https://plugins.trac.wordpress.org/browser/contact-form-7-multi-step-module/tags/4.7/cf7msm.php#L1444
• https://plugins.trac.wordpress.org/browser/contact-form-7-multi-step-module/tags/4.7/cf7msm.php#L225
• https://plugins.trac.wordpress.org/browser/contact-form-7-multi-step-module/tags/4.7/cf7msm.php#L395
• https://github.com/coreyt808/webheadcoder-multi-step-forms-for-contact-form-7/commit/16f71561797b71548021dc9c4e30b0456e718cd3
• https://plugins.trac.wordpress.org/browser/contact-form-7-multi-step-module/tags/4.7.1/cf7msm.php

• Webheadcoder Multi-Step Forms for Contact Form 7 <= 4.7 - Reflected Cross-Site Scripting via 'l10n_print_after' Parameter · Newly collected advisory · 28 Oct 2026