webheadllc vulnerabilities and threats

The Webheadcoder Multi-Step Forms for Contact Form 7 WordPress plugin versions up to and including 4.7 are vulnerable to reflected Cross-Site Scripting (XSS) via the 'l10n_print_after' parameter. This vulnerability allows unauthenticated attackers to inject arbitrary scripts that execute when a user interacts with a crafted link. Exploitation requires the targeted site to have at least one Contact Form 7 form configured with a [multistep] form-tag. The vulnerability is mitigated in non-multistep forms starting from version 4.7 due to canonicalization blocking the attack path.