{"error":0,"message":null,"data":{"name":"Webheadcoder Multi-Step Forms for Contact Form 7","plugin":"contact-form-7-multi-step-module","link":"https:\/\/wordpress.org\/plugins\/contact-form-7-multi-step-module\/","latest":"1786931460","closed":0,"closed_reason":null,"closed_date":null,"vulnerability":[{"uuid":"d26b951e3358fc61db95235eb36ec12cd30a27c8b8d4029db2de24ac780dd2df","name":"Webheadcoder Multi-Step Forms for Contact Form 7 [contact-form-7-multi-step-module] < 4.1.91","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"4.1.91","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"659bf7cf7d621ed1044ff6868a120ce48fc6dbd2","name":"WordPress Contact Form 7 Multi-Step Forms plugin < 4.1.91 - Sensitive Information Disclosure vulnerability","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/contact-form-7-multi-step-module\/vulnerability\/wordpress-contact-form-7-multi-step-forms-plugin-4191-sensitive-information-disclosure-vulnerability","description":"Sensitive Information Disclosure vulnerability discovered in WordPress Contact Form 7 Multi-Step Forms plugin (versions < 4.1.91).","date":"2022-02-28"}],"impact":[]},{"uuid":"54f6740d846c123ca59130445804a11900da41396fc53dfddb18dd6e850b96db","name":"Webheadcoder Multi-Step Forms for Contact Form 7 [contact-form-7-multi-step-module] < 4.1.91","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"4.1.91","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"bcef765435db36c0f9c938bf4d02a8664786052b","name":"WordPress Contact Form 7 Multi-Step Forms plugin < 4.1.91 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/contact-form-7-multi-step-module\/vulnerability\/wordpress-contact-form-7-multi-step-forms-plugin-4191-toggle-the-debug-mode-via-cross-site-request-forgery-csrf-vulnerability","description":"Sensitive Information Disclosure vulnerability discovered in WordPress Contact Form 7 Multi-Step Forms plugin (versions < 4.1.91).","date":"2022-02-28"}],"impact":[]},{"uuid":"c002f88cb9ae7f4716aaccd9258b5297f58fcbc414cb02f4f99a5a8ea69b46e7","name":"Webheadcoder Multi-Step Forms for Contact Form 7 [contact-form-7-multi-step-module] < 3.0.9","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"3.0.9","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"051bc4291357df896ab965a8896945a971a3b05f","name":"WordPress Contact Form 7 Multi-Step Forms plugin <= 3.0.8 - Authenticated Option Update vulnerability (Fremius Library security issue)","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/contact-form-7-multi-step-module\/vulnerability\/wordpress-contact-form-7-multi-step-forms-plugin-3-0-8-authenticated-option-update-vulnerability-fremius-library-security-issue","description":"Authenticated Option Update vulnerability (Fremius Library security issue) found in WordPress Contact Form 7 Multi-Step Forms plugin (versions <= 3.0.8).","date":"2019-03-05"}],"impact":[]},{"uuid":"64387fd65d50b6ae111f501c1bf4c6bbde72d9ca83a97b76455f04d8129154df","name":"Webheadcoder Multi-Step Forms for Contact Form 7 [contact-form-7-multi-step-module] < 3.0.9","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"3.0.9","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"6ff37c2e-e21d-4abc-bafe-8ca6a2c1ed76","name":"Freemius Library &lt; 2.2.4 - Subscriber+ Arbitrary Option Update","link":"https:\/\/wpscan.com\/vulnerability\/6ff37c2e-e21d-4abc-bafe-8ca6a2c1ed76","description":"The library, used in numerous plugins, does not have proper authorisation when updating blog options, allowing any authenticated users, such as subscriber to update arbitrary options","date":null}],"impact":[]},{"uuid":"4a8d1996e7a1f0301213d34b1fd0584a3ccef2c55e483d89786735ab983a361e","name":"Webheadcoder Multi-Step Forms for Contact Form 7 [contact-form-7-multi-step-module] < 4.1.91","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"4.1.91","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"6d8910c719b2a132ec93828cd37e418b19cac960","name":"Freemius SDK <= 2.4.2 - Missing Authorization Checks","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/detail\/freemius-sdk-242-missing-authorization-checks","description":"The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the _get_debug_log, _get_db_option, and the _set_db_option functions in versions up to, and including 2.4.2. Any WordPress plugin or theme running a version of Freemius less than 2.4.3 is vulnerable.","date":"2022-03-04"},{"id":"CVE-2022-4974","name":"Freemius SDK <= 2.4.2 - Missing Authorization Checks","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2022-4974","description":"The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the _get_debug_log, _get_db_option, and the _set_db_option functions in versions up to, and including 2.4.2. Any WordPress plugin or theme running a version of Freemius less than 2.4.3 is vulnerable.","date":"2024-10-16"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:U\/C:L\/I:L\/A:L","av":"n","ac":"l","pr":"l","ui":"n","s":"u","c":"l","i":"l","a":"l","score":"6.3","severity":"m","exploitable":"2.8","impact":"3.4"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:U\/C:L\/I:L\/A:L","score":"6.3","severity":"medium","av":"network","ac":"low","pr":"low","ui":"none","s":"unchanged","c":"low","i":"low","a":"low","exploitable":"2.8","impact":"3.4"},"cwe":[{"cwe":"CWE-862","name":"Missing Authorization","description":"The product does not perform an authorization check when an actor attempts to access a resource or perform an action."}],"ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","kev":false,"kev_date":null}}},{"uuid":"2c5933fd3159c941696dc85c7de530bb1868c39097fda8f5a6c6c7c86cfb077c","name":"Webheadcoder Multi-Step Forms for Contact Form 7 [contact-form-7-multi-step-module] < 3.0.9","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"3.0.9","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"7e57cd4f4859826de00a8e2b09ee24fb7f2d824b","name":"Freemius SDK <= 2.2.3 - Missing Authorization to Arbitrary Options Update","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/detail\/freemius-sdk-223-missing-authorization-to-arbitrary-options-update","description":"The Freemius SDK for WordPress is vulnerable to authorization bypass due to a missing capability check on the _get_db_option and _set_db_option functions in versions up to, and including, 2.2.3. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to change site settings and potentially take over the site.","date":"2019-02-25"}],"impact":[]},{"uuid":"600e93ab2d0515b21d7bea356695b7346359f7b11a7bb06258b597d9825bbc5e","name":"Webheadcoder Multi-Step Forms for Contact Form 7 [contact-form-7-multi-step-module] < 4.3.1","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"4.3.1","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2023-33999","name":"CVE-2023-33999","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2023-33999","description":"[en] Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in WPVibes WP Mail Log allows DOM-Based XSS.\n\nThis issue affects WP Mail Log: from n\/a through 1.0.2.","date":"2026-06-11"},{"id":"72e63c6306a6c4e01d4ee04de9bcdad5385ca2c7","name":"WordPress  Contact Form 7 Multi-Step Forms Plugin  < 4.3.1 is vulnerable to Cross Site Scripting (XSS)","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/contact-form-7-multi-step-module\/vulnerability\/wordpress-contact-form-7-multi-step-forms-plugin-4-3-1-reflected-cross-site-scripting-xss-vulnerability","description":"Update the plugin to the latest version.\nRafie Muhammad (Patchstack) discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Contact Form 7 Multi-Step Forms Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site.  This vulnerability has been fixed in version 4.3.1.","date":"2023-07-18"},{"id":"39d1f22f-ea34-4d94-9dc2-12661cf69d36","name":"Freemius SDK &lt; 2.5.10 - Reflected Cross-Site Scripting","link":"https:\/\/wpscan.com\/vulnerability\/39d1f22f-ea34-4d94-9dc2-12661cf69d36","description":"The Freemius SDK for WordPress does not adequately sanitize inputs or escape outputs, leading to Reflected Cross-Site Scripting. This directly affects over 1000 plugins and themes that use this SDK.","date":"2023-07-18"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:R\/S:C\/C:L\/I:L\/A:L","av":"n","ac":"l","pr":"n","ui":"r","s":"c","c":"l","i":"l","a":"l","score":"7.1","severity":"h","exploitable":"0.0","impact":"0.0"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:R\/S:C\/C:L\/I:L\/A:L","score":"7.1","severity":"high","av":"network","ac":"low","pr":"none","ui":"required","s":"changed","c":"low","i":"low","a":"low","exploitable":"0.0","impact":"0.0"},"cwe":[{"cwe":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users."}],"ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","kev":false,"kev_date":null}}},{"uuid":"1e5930e0ccb64b70bdefb57cc8c1d2c446867794e73967b898603cec4cf38a25","name":"Webheadcoder Multi-Step Forms for Contact Form 7 [contact-form-7-multi-step-module] < 4.4.2","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"4.4.2","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2024-13362","name":"CVE-2024-13362","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2024-13362","description":"[en] Multiple plugins and\/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.","date":"2026-05-01"},{"id":"e69f66150211a010ec7d19f7fddd873a7a9523ac","name":"Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/detail\/freemius-2101-reflected-dom-based-cross-site-scripting-via-url-parameter","description":"Multiple plugins and\/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.","date":"2026-04-30"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:R\/S:C\/C:L\/I:L\/A:N","av":"n","ac":"l","pr":"n","ui":"r","s":"c","c":"l","i":"l","a":"n","score":"6.1","severity":"m","exploitable":"0.0","impact":"0.0"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:R\/S:C\/C:L\/I:L\/A:N","score":"6.1","severity":"medium","av":"network","ac":"low","pr":"none","ui":"required","s":"changed","c":"low","i":"low","a":"none","exploitable":"0.0","impact":"0.0"},"cwe":[{"cwe":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users."}],"ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","kev":false,"kev_date":null}}}]},"updated":"1777700629"}