Database for Contact Form 7, WPforms, Elementor forms vulnerabilities

SQL Injection vulnerability in the WordPress plugin 'Database for Contact Form 7, WPforms, Elementor forms' before version 1.5.5. A parameter is not properly sanitized and escaped before being used in a SQL statement, allowing SQL injection by users with a specific capability (default administrators, but can be delegated).

The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before version 1.5.3 does not properly sanitize and escape a parameter before reflecting it back in an admin page. This leads to a Reflected Cross-Site Scripting (XSS) that could be used against high-privilege users such as admins.

The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before version 1.5.2 does not restrict allowed PHP classes when unserializing an attacker-supplied form-field value. This allows unauthenticated users to inject arbitrary PHP objects that are instantiated when an administrator views the stored entry. This is an incomplete fix of CVE-2025-7384 and CVE-2026-2599, whose deserialization paths were hardened while the entry-editor file-field path was missed.

The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress up to version 1.5.1 contains an arbitrary file copy vulnerability. The create_entry_el() function passes the raw_value from Elementor Pro's Form_Record object directly to PHP's copy() without validation, allowing an attacker to copy any file from the server or from an external URL.