Threats tagged 'ghsa-r9gv-cvj6-3xw9'

The Multi Step for Contact Form 7 WordPress plugin is vulnerable to stored cross-site scripting (XSS) via the 'multipart field name (array key)' parameter in all versions up to and including 2.9.1. This vulnerability arises from insufficient input sanitization and output escaping. Exploitation requires the 'Save every step' option enabled on the target form and the Database for Contact Form 7 companion plugin active with its 'Expandable' table option enabled, both disabled by default.