CVE-2018-14430: Mondula Multi Step Form

Medium severity, CVSS 6.1. EPSS: 1.3% chance of exploitation in the next 30 days.

The Mondula Multi Step Form plugin through 1.2.5 for WordPress allows XSS via the fw_data [id][1], fw_data [id][2], fw_data [id][3], fw_data [id][4], or email field of the contact form, exploitable with an fw_send_email action to wp-admin/admin-ajax.php.

Affected products

• Mondula Multi Step Form: up to and including 1.2.5

Published 2018-07-25. Last modified 2026-06-17.