Multi Step Form
Multi Step Form has 9 disclosed vulnerabilities in the WordSec catalog, reported between 2018 and 2025; all 9 are fixed as of September 2026. Their average CVSS score is 5.4, and the most serious one scores 7.2 out of 10. Severity breakdown: 0 critical and 1 high. 2025 was the busiest year with 2 disclosures.
The most common weakness is Cross-Site Scripting, behind 4 of the records (44%). Other recurring categories include Cross-Site Request Forgery (CSRF), Missing Authorization.
Every one of the 9 issues recorded for Multi Step Form has a vendor fix available, so running the current release closes all known holes.
8 independent researchers contributed these findings, most of them (2) reported by Benmalek Aymen (centaurus). Multi Step Form is installed on roughly 9,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.8.8.
CVE-2025-9515Multi Step Form <= 1.7.25 - Authenticated (Admin+) Arbitrary File Upload
Read the full analysisVulnerability Records

Multi Step Form
Author
mondula2016
Multi Step Form has a drag & drop enabled form builder for quick and intuitive creation of nice-looking multi step forms. Forms can be embedded on any page or post with shortcodes or with Gutenberg blocks. Getting started Read our documentation Demo Check out our live demo Get more information Visit our landing page Contribute The “Multi Step Form” base plugin is OPEN SOURCE KEY FEATURES: ANIMATED PROGRESS BAR Use our customizable & animated progress bar to guide your users through your forms. Change the colors to match your corporate identity (CI). FULLY RESPONSIVE Perfect for mobile access! The frontend of Multi Step Form is fully responsive. It can be used and submitted on all devices. We made sure that the form output can be optimally displayed on all screen resolutions. DRAG & DROP Creating forms is as easy as never before. Use drag & drop to place the fields in your form. Fields can be moved and rearranged at any time. The individual steps can also be moved so that the sequence can be reordered or expanded effortlessly. EASY BACKEND The backend’s structure is simple. Even less technical users can quickly understand the plugin and start creating forms. Other features: Standard form elements– You can use all standard form elements such as “radio buttons”, “checkboxes”, “select”, “textfield” and so on… File Upload– Include dynamic file-uploads in your multi step form Validated email– The email field uses a included validation script. Calendar item– Styled datepicker included. Show summary– At the end of each form you can display a short summary. Multisite compatibility– The plugin works on WordPress multisite installs. reCAPTCHA v2– You can enable reCAPTCHA v2 validation for your forms. GET Parameters– You can integrate GET parameters in your forms. String replacements– Use string replacements to create subjects based on form inputs. Watch the video MULTI STEP FORM PLUS Plus features: Up to 10 steps– You can now divide your form in up to 10 Steps Save form data– The forms will now be saved in the backend. Easily make some evaluations. Conditional fields– You want to bring more variety to your forms. Use conditional fields. Export as CSV-List– You want to use the form data in e.g. Excel. Export your forms as CSV. UPGRADE NOW
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C