Skip to main content

Database For Contact Form 7 Wpforms Elementor Forms CVE-2026-14870

| EUVDEUVD-2026-49701 HIGH
Cross-site Scripting (XSS) (CWE-79)
2026-07-28 WPScan GHSA-5cch-gjr9-6pjq
XSS WordPress Database For Contact Form 7 Wpforms Elementor Forms
7.1
CVSS 3.1 · Vendor: WPScan
Share

Severity by source

Vendor (WPScan) PRIMARY
7.1 HIGH
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Primary rating from Vendor (WPScan) · only source for this CVE.

CVSS VectorVendor: WPScan

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
Low

Lifecycle Timeline

5
Analysis Generated
Jul 28, 2026 - 19:05 vuln.today
CVSS changed
Jul 28, 2026 - 14:37 NVD
7.1 (HIGH)
Patch available
Jul 28, 2026 - 07:01 EUVD
CVE Published
Jul 28, 2026 - 06:00 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 28, 2026 - 06:00 cve.org
HIGH 7.1

DescriptionCVE.org

The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.3 does not properly sanitise and escape a parameter before reflecting it back in an admin page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.

Articles & Coverage 1

News 19 New WordPress Vulnerabilities - 2 Critical, 17 High Jul 29, 2026

AnalysisAI

We need to generate a JSON object with the specified fields, synthesizing all provided data about CVE-2026-14870. First, parse the input: CVE ID: CVE-2026-14870 Description: The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.3 does not properly sanitise and escape a parameter before reflecting it back in an admin page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Database For Contact Form 7 Wpforms Elementor Forms

View all
CVE-2026-12081 MEDIUM POC
5.0 Jul 13

PHP object injection in the 'Database for Contact Form 7, WPforms, Elementor forms' WordPress plugin (all versions befor
CVE-2026-9843 HIGH
8.1 Jun 20

Arbitrary file deletion in the Database for Contact Form 7, WPforms, Elementor forms WordPress plugin (versions ≤1.5.1)

CVE-2024-1069 HIGH
7.2 Jan 31

The Contact Form Entries plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file validatio
CVE-2026-9145 MEDIUM
6.5 Jul 02

Arbitrary file copy in the Database for Contact Form 7, WPforms, Elementor Forms WordPress plugin (versions ≤ 1.5.1) exp
CVE-2023-31095 MEDIUM
4.7 Dec 29

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks Integration for HubSpot and Contact Form

Same weakness CWE-79 – Cross-site Scripting (XSS)

View all
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2016-8581 MEDIUM POC
6.1
CVE-2013-5223 MEDIUM POC
5.4
CVE-2025-52367 MEDIUM POC
5.4
CVE-2015-0072 MEDIUM POC
4.3

Same technique XSS

View all
CVE-2017-9248 CRITICAL POC
9.8
CVE-2013-1710 CRITICAL POC
10.0
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2024-52875 HIGH POC
8.8
CVE-2016-8581 MEDIUM POC
6.1

Share

CVE-2026-14870 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy