What’s Vulnerable › Vulnerabilities

CVE-2018-14846

• Severity: medium (CVSS 5.4 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.1% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2018-12-20 · updated 2026-06-17
• Weakness: CWE-79

Description

The Mondula Multi Step Form plugin before 1.2.8 for WordPress has multiple stored XSS via wp-admin/admin-ajax.php.

Affected products

• Mondula GmbH Multi Step Form: before 1.2.8 — fixed in 1.2.8

How to fix

Upgrade to a fixed version: Mondula GmbH Multi Step Form 1.2.8. Check the vendor advisory for mitigations.

References

• https://ansawaf.blogspot.com/2018/10/cve-2018-14846-multiple-stored-xss-in.html
• https://cwatch.comodo.com/blog/website-security/vulnerability-found-in-multiple-stored-xss-form-in-wordpress-version-1-2-5/
• https://wpvulndb.com/vulnerabilities/9186
• https://ansawaf.blogspot.com/2018/10/cve-2018-14846-multiple-stored-xss-in.html
• https://cwatch.comodo.com/blog/website-security/vulnerability-found-in-multiple-stored-xss-form-in-wordpress-version-1-2-5/
• https://wpvulndb.com/vulnerabilities/9186

Get alerted when CVE-2018-14846 or the next vulnerability affects your stack