The Webheadcoder Multi‑Step Forms for Contact Form 7 plugin contains an input validation flaw in the l10n_print_after parameter, allowing unauthenticated attackers to inject arbitrary JavaScript into pages. The injected payload is reflected back to the victim when they click a crafted link, enabling session hijacking, cookie theft, or defacement. This weakness is a classic reflected XSS flaw (CWE‑79).

The vulnerability affects all WordPress sites that use the Webheadcoder Multi‑Step Forms for Contact Form 7 plugin up to and including version 4.7. It requires at least one Contact Form 7 form configured with the multistep form‑tag; the canonicalization change in 4.7 blocks the attack vector on non‑multistep forms. All sites running any of the vulnerable plugin versions are at risk until the plugin is upgraded.

With a CVSS score of 6.1, the flaw presents moderate severity. No EPSS data is available, but the vulnerability is not listed in CISA KEV. Attackers can exploit it remotely by creating a link that includes malicious content in the l10n_print_after parameter and luring site visitors into clicking it. Successful exploitation requires a public contact form with the multistep tag and a user who follows the link, making it a classical XSS exploitation scenario.