WordPress security by component

Multi Step Form

Plugin description

Multi Step Form is a WordPress component with 9 published CVE records in this archive. The latest tracked vulnerability was published Sep 06, 2025; the highest CVE/CNA score is 7.2.

Plugin slug: multi-step-form

Latest vulnerability

CVE-2025-9515: Multi Step Form: Dangerous file upload

Multi Step Form is affected by dangerous file upload. Exploitation requires at least administrator-level access. Successful exploitation can place attacker-controlled executable content on the server and may lead to full site compromise.

PublishedSep 06, 2025

Safe version guidanceSee mitigation notes

		Safe version
Sep 06, 2025	CVE-2025-9515 Multi Step Form: Dangerous file upload Multi Step Form is affected by dangerous file upload. Exploitation requires at least administrator-level access. Successful exploitation can place attacker-controlled executable content on the server and may lead to full site compromise.	See mitigation notes	CVE7.2 NVDPending
Jan 16, 2025	CVE-2024-12427 Multi Step Form: A security weakness Multi Step Form is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE5.3 NVDPending
Oct 29, 2024	CVE-2024-50428 Multi Step Form: A security weakness Multi Step Form is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE4.3 NVD9.8
Feb 21, 2024	CVE-2024-25905 Multi Step Form: Cross-site request forgery Multi Step Form is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.	See mitigation notes	CVE5.4 NVD5.4
Dec 21, 2023	CVE-2023-50832 Multi Step Form: Cross-site scripting Multi Step Form is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE5.9 NVD4.8
Nov 22, 2023	CVE-2023-47758 Multi Step Form: Cross-site request forgery Multi Step Form is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.	See mitigation notes	CVE5.4 NVD8.8
Jan 09, 2023	CVE-2022-4196 Multi Step Form: Cross-site scripting Multi Step Form is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE4.8 NVD4.8
Dec 20, 2018	CVE-2018-14846 Multi Step Form: Cross-site scripting Multi Step Form is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE5.4 NVD5.4
Jul 25, 2018	CVE-2018-14430 Multi Step Form: Cross-site scripting Multi Step Form is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.1 NVD6.1