Extension WordPress
Vulnérabilités Multi Step Form
Cette page rassemble les failles publiées pour Multi Step Form, leurs plages de versions affectées et les correctifs signalés dans la base locale.
Historique de sécurité
CVE et vulnérabilités de Multi Step Form
9 fiches
Multi Step Form <= 1.7.25 – Authenticated (Admin+) Arbitrary File Upload
The Multi Step Form plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation via the import functionality in all versions up to, and including, 1.7.25. This makes it possible for authenticated attackers,…
*-1.7.25
1.7.26
05/09/2025
Multi Step Form <= 1.7.23 – Missing Authorization to Unauthenticated Limited File Upload
The Multi Step Form plugin for WordPress is vulnerable to unauthorized limited file upload due to a missing capability check on the fw_upload_file AJAX action in all versions up to, and including, 1.7.23. This makes it possible for…
*-1.7.23
1.7.24
15/01/2025
Multi Step Form <= 1.7.21 – Missing Authorization via fw_delete_files
The Multi Step Form plugin for WordPress is vulnerable to unauthorized deletion of files due to a missing capability check on the fw_delete_files function in versions up to, and including, 1.7.21. This makes it possible for unauthenticated attackers…
*-1.7.21
1.7.22
24/10/2024
Multi Step Form <= 1.7.18 – Cross-Site Request Forgery
The Multi Step Form plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.7.18. This is due to missing or incorrect nonce validation on an unknown function. This makes it possible…
*-1.7.18
1.7.19
12/02/2024
Multi Step Form <= 1.7.16 – Authenticated (Administrator+) Stored Cross-Site Scripting
The Multi Step Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.7.16 due to insufficient input sanitization and output escaping. This makes it possible for authenticated…
*-1.7.16
1.7.17
19/12/2023
Multi Step Form <= 1.7.12 – Cross-Site Request Forgery
The Multi Step Form plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.7.12. This is due to missing or incorrect nonce validation on the menu() function. This makes it possible…
*-1.7.12
1.7.13
13/11/2023
Multi Step Form <= 1.7.7 – Authenticated (Administrator+) Stored Cross-Site Scripting
The Multi Step Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several of its form fields in versions up to, and including, 1.7.7 due to insufficient input sanitization and output escaping. This makes it possible…
*-1.7.7
1.7.8
17/12/2022
Multi Step Form <= 1.2.5 – Stored Cross-Site Scripting
The Mondula Multi Step Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘fw_wizard_save’ action in versions up to, and including, 1.2.5 due to insufficient input sanitization and output escaping. This makes it possible for…
[*, 1.2.6)
1.2.6
27/07/2018
Multi Step Form <= 1.2.5 – Reflected Cross-Site Scripting
The Mondula Multi Step Form plugin through 1.2.5 for WordPress allows XSS via the fw_data [id][1], fw_data [id][2], fw_data [id][3], fw_data [id][4], or email field of the contact form, exploitable with an fw_send_email action to wp-admin/admin-ajax.php.
[*, 1.2.6)
1.2.6
20/07/2018
Extensions également surveillés
WP Commander
Rechercher dans toute la base WordPress
Utilisez la recherche globale pour retrouver une extension, un thème, une CVE ou un identifiant de vulnérabilité.