CVE-2026-14870
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before version 1.5.3 does not properly sanitize and escape a parameter before reflecting it back in an admin page. This leads to a Reflected Cross-Site Scripting (XSS) that could be used against high-privilege users such as admins.
Risk Assessment
The organization risks admin account takeover through execution of a malicious script in the victim's browser.
Recommendation
Immediately update the Database for Contact Form 7, WPforms, Elementor forms plugin to version 1.5.3 or later.
Other vulnerabilities in Database for Contact Form 7, WPforms, Elementor forms
See all- CVE-2026-14872Medium
SQL Injection vulnerability in the WordPress plugin 'Database for Contact Form 7, WPforms, Elementor forms' before version 1.5.5. A parameter is not properly sanitized and escaped before being used in a SQL statement, allowing SQL injection by users with a specific capability (default administrators, but can be delegated).
- CVE-2026-12081Medium
The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before version 1.5.2 does not restrict allowed PHP classes when unserializing an attacker-supplied form-field value. This allows unauthenticated users to inject arbitrary PHP objects that are instantiated when an administrator views the stored entry. This is an incomplete fix of CVE-2025-7384 and CVE-2026-2599, whose deserialization paths were hardened while the entry-editor file-field path was missed.
- CVE-2026-9145Medium
The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress up to version 1.5.1 contains an arbitrary file copy vulnerability. The create_entry_el() function passes the raw_value from Elementor Pro's Form_Record object directly to PHP's copy() without validation, allowing an attacker to copy any file from the server or from an external URL.
Original NVD description (English source)
The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.3 does not properly sanitise and escape a parameter before reflecting it back in an admin page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.