Threats tagged 'ghsa-mrh3-5w6m-2g2x'

The Webheadcoder Multi-Step Forms for Contact Form 7 WordPress plugin is vulnerable to reflected cross-site scripting (XSS) via the 'l10n_print_after' parameter in all versions up to and including 4.7. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary scripts. Exploitation requires the targeted site to have at least one Contact Form 7 form configured with a [multistep] form-tag, as version 4.7 introduced canonicalization that blocks the attack on non-multistep forms.