What is the CVSS score of CVE-2026-14870?

CVE-2026-14870 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of CF7 Database are affected by CVE-2026-14870?

The WordPress plugin Database for Contact Form 7, WPForms, Elementor Forms (Database for CF7) prior to version 1.5.3 contains a reflected cross-site scripting flaw that can execute malicious script…. A patch is available.

Is there a public PoC exploit available for CVE-2026-14870?

Yes, a public proof-of-concept exploit is available for CVE-2026-14870. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-14870?

Within 24 hours, identify all WordPress installations running Database for Contact Form 7, WPForms, Elementor Forms (Database for CF7) versions earlier than 1.5.3, apply the vendor-released patch 1.5.3 where possible, and if immediate patching is not feasible, temporarily deactivate the plugin or restrict administrative access; within 7 days, verify that all affected sites are updated to 1.5.3 or later, enforce multi-factor authentication for WordPress administrators, review admin account activity and logs for suspicious redirects or script execution, and brief administrators not to click unsolicited links; within 30 days, add this plugin and version check to routine vulnerability scanning and patch-management workflows, restrict administrative page access to trusted networks where practical, and conduct a follow-up audit to confirm no indicators of compromise remain.

CF7 Database CVE-2026-14870

EUVD-2026-49701 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-28 WPScan

GHSA-5cch-gjr9-6pjq

WordPress XSS Database For Contact Form 7 Wpforms Elementor Forms

7.1

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

7.1 HIGH

Standard reflected XSS: remote and low-complexity with no attacker privileges, but requires admin interaction (UI:R) and executes in the admin origin (S:C) with limited C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 28, 2026 - 19:05 vuln.today

CVSS changed

Jul 28, 2026 - 14:37 NVD

7.1 (HIGH)

Patch available

Jul 28, 2026 - 07:01 EUVD

CVE Published

Jul 28, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 28, 2026 - 06:00 cve.org

HIGH 7.1

DescriptionCVE.org

The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.3 does not properly sanitise and escape a parameter before reflecting it back in an admin page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.

Articles & Coverage 1

News 19 New WordPress Vulnerabilities - 2 Critical, 17 High Jul 29, 2026

AnalysisAI

Reflected cross-site scripting in the WordPress plugin 'Database for Contact Form 7, WPForms, Elementor Forms' (Database for CF7) before version 1.5.3 allows an unauthenticated remote attacker to inject script into an administrative page via a request parameter that is echoed back without sanitisation or escaping. Exploitation is not automatic: the attacker must deliver a crafted URL and a logged-in WordPress administrator must click it, but because the CVSS vector assigns S:C the script executes in the admin's privileged context, enabling session abuse, malicious admin-side actions, or further compromise of the site. Publicly available exploit code exists and the vendor has released version 1.5.3 as the fix; EPSS is low at 0.15% (5th percentile), SSVC rates the issue as POC-based but non-automatable with partial technical impact, and it is not confirmed as actively exploited (not listed in CISA KEV).

Technical ContextAI

The affected component is a third-party WordPress plugin that stores and displays form submissions from Contact Form 7, WPForms, and Elementor Forms inside the WordPress administrative dashboard; the CPE entry cpe:2.3:a:unknown:database_for_contact_form_7,_wpforms,_elementor_forms:*:*:*:*:*:*:*:* identifies the package with a wildcard version and an unlisted vendor. The root cause is CWE-79 (Improper Neutralisation of Input During Web Page Generation), specifically a reflected variant: one of the plugin's admin pages takes a request parameter and prints it back into the HTML response without output encoding, so injected markup/JavaScript is parsed by the administrator's browser. CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L reflects a network-reachable, low-complexity attack that needs no attacker authentication but does require user interaction (the admin clicking the link), with a scope change because the vulnerable component's output crosses into the privileged admin browsing context; confidentiality, integrity, and availability impacts are limited. SSVC classifies exploitation as 'poc' with 'Automatable: no', consistent with a reflected XSS that must be socially engineered per victim rather than mass-triggered.

RemediationAI

Vendor-released patch: upgrade the 'Database for Contact Form 7, WPForms, Elementor Forms' plugin to version 1.5.3 or later, which should be applied through the WordPress plugin updater or by reinstalling the plugin from the official directory; patch availability is confirmed by the vendor per the WPScan advisory at https://wpscan.com/vulnerability/d574b78c-df04-4dab-bd33-e3a22ff51918/ (see also https://nvd.nist.gov/vuln/detail/CVE-2026-14870). If an immediate update is not possible, the most effective compensating control is to deactivate the plugin entirely, accepting the operational trade-off that stored form-submission records and the admin dashboard view of those submissions become unavailable until the plugin is reinstalled at 1.5.3. Additional hardening: restrict access to wp-admin (for example, via an IP allowlist, HTTP authentication, or a security plugin) so that only trusted networks can load the affected admin pages, at the cost of added friction for legitimate administrators; deploy a WAF rule that filters script-bearing characters in query parameters reaching plugin admin pages, recognising that obfuscation can bypass signature-based filtering; and train administrators not to follow unsolicited links into wp-admin, since the exploit requires a logged-in admin to click the crafted URL. Because this is a reflected (not stored) XSS, no database cleanup is required after patching, and no further containment steps are needed beyond confirming that all sites running the plugin report version 1.5.3 or higher.