CF7 Database CVE-2026-14870

Exploitation requires a specific parameter on one of the plugin's admin pages (versions before 1.5.3) that is reflected without proper sanitization/escaping; the attacker must deliver a crafted link and a high-privilege user - explicitly an authenticated WordPress administrator - must be logged in and click it (UI:R). Limiting factors: it is reflected (not stored), so it needs per-victim social engineering rather than passive triggering; SSVC marks it non-automatable; and it is ineffective if the admin does not follow the attacker-supplied URL or if the site has been updated to 1.5.3 or later.

Signals are internally consistent and point to a genuine but bounded risk. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L → 7.1) is well-calibrated for a reflected XSS: network-reachable, low complexity, no attacker privileges, but requiring victim interaction (UI:R) and a scope change (S:C) because script executes in the WordPress admin origin. EPSS is low at 0.15% (5th percentile) and SSVC records Exploitation: poc, Automatable: no, Technical Impact: partial - meaning a proof-of-concept exists (confirmed by the WPScan reference) but no evidence of active, automated exploitation. This is NOT actively exploited: not in CISA KEV. The 'partial' technical impact and low/low/low CVSS impacts correctly reflect that this yields session/action hijacking against an admin rather than direct code execution. Net: a legitimate 'patch-in-normal-cycle' issue rather than an emergency - real because a working PoC exists and the target is a high-privilege admin, but limited because it requires social-engineering an authenticated admin to click a crafted link and is not automatable.

An attacker crafts a malicious URL for the plugin's admin page embedding JavaScript in the unsanitized reflected parameter, then phishes a logged-in WordPress administrator into clicking it. When the admin's browser loads the page, the injected script runs in the wp-admin origin and can perform admin actions (e.g., create a rogue admin, alter settings, or exfiltrate nonces/session data). A publicly available proof-of-concept is published via WPScan.