Database For Contact Form 7 Wpforms Elementor Forms
Monthly
We need to generate a JSON object with the specified fields, synthesizing all provided data about CVE-2026-14870. First, parse the input: CVE ID: CVE-2026-14870 Description: The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.3 does not properly sanitise and escape a parameter before reflecting it back in an admin page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. CVSS Score: 7.1 CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L CWE: CWE-79 EPSS: 0.15% (percentile 5%) POC/Exploit: Publicly available Patch: Available from vendor Reported by: WPScan CPE: cpe:2.3:a:unknown:database_for_contact_form_7,_wpforms,_elementor_forms:*:*:*:*:*:*:*:* Tags: XSS, WordPress, Database For Contact Form 7 Wpforms Elementor Forms SSVC: Exploitation: poc, Automatable: no, Technical Impact: partial ENISA EUVD ID: EUVD-2026-49701 Affected versions (EUVD): ["Database for Contact Form 7, WPforms, Elementor forms 0 <1.5.3"] References: [cveorg] (exploit) https://wpscan.com/vulnerability/d574b78c-df04-4dab-bd33-e3a22ff51918/ [euvd] (advisory) https://nvd.nist.gov/vuln/detail/CVE-2026-14870 Now, construct each field as a paragraph string. product_name: The plugin name is "Database for Contact Form 7, WPforms, Elementor forms". So product_name: "Database for Contact Form 7, WPforms, Elementor forms" – but that's long, but permissible as a product name. The task says "1-3 words ONLY." That's problematic because the product name is longer. I need to pick a short name. The plugin's main purpose: it's a database plugin for those form plugins. Maybe "WordPress Forms Database" or "Database for CF7, WPforms, Elementor Forms"? But I must keep it 1-3 words. The plugin name as per WPScan: "Database for Contact Form 7, WPforms, Elementor forms". I could shorten to "Database for Contact Form 7, WPforms, Elementor forms plugin"? No, that's too long. The instruction says: "product_name": "1-3 wor
Arbitrary file deletion in the Database for Contact Form 7, WPforms, Elementor forms WordPress plugin (versions ≤1.5.1) allows remote unauthenticated attackers to poison form entries with traversal payloads that, when later viewed by an administrator, delete arbitrary server files and can be escalated to remote code execution by removing wp-config.php. Reported by Wordfence with publicly available exploit code exists via the Wordfence advisory; no public exploit identified at time of analysis as weaponized in-the-wild attacks, and the issue is not in CISA KEV.
SQL injection in the Database for Contact Form 7, WPforms, Elementor forms WordPress plugin (versions before 1.5.5) exposes the underlying WordPress database to unauthorized read access by any user holding a specific capability that defaults to administrators but can be explicitly delegated to lower-privileged roles. The CVSS scope-change rating (S:C/C:H) reflects that a successful injection reaches beyond the plugin itself into the shared WordPress database, potentially exposing all stored form submissions, user data, and other sensitive records. Publicly available exploit code exists per WPScan; however, EPSS at 0.16% (5th percentile) and absence from CISA KEV indicate no confirmed widespread active exploitation at time of analysis.
PHP object injection in the 'Database for Contact Form 7, WPforms, Elementor forms' WordPress plugin (all versions before 1.5.2) permits unauthenticated attackers to embed malicious serialized PHP objects via the entry-editor file-field path, which are instantiated server-side when an administrator views the stored form entry. This is an incomplete remediation of two prior CVEs (CVE-2025-7384 and CVE-2026-2599) - earlier patches hardened other deserialization paths within the same plugin while this specific code route was overlooked. A publicly available exploit exists; no active exploitation is confirmed by CISA KEV at time of analysis.
Arbitrary file copy in the Database for Contact Form 7, WPforms, Elementor Forms WordPress plugin (versions ≤ 1.5.1) exposes any file readable by the PHP process to unauthenticated network attackers. The `create_entry_el()` function accepts attacker-controlled POST data as a file path and passes it directly to PHP's `copy()`, which transparently accepts both local filesystem paths and remote URLs - enabling server file exfiltration or remote resource staging. Exploitation requires Elementor Pro to be installed and active alongside the vulnerable plugin; no public exploit or CISA KEV listing has been identified at time of analysis, though the unauthenticated network vector and high confidentiality impact make this a credible priority for mixed Elementor Pro deployments.
Authenticated attackers with Contributor-level access or above can extract all form submissions from the Database for Contact Form 7, WPforms, Elementor Forms WordPress plugin (versions up to 1.4.9) via a missing capability check in the entries_shortcode() function, exposing names, emails, phone numbers, and other sensitive form data. The vulnerability requires existing WordPress user credentials but no administrative privileges, making it accessible to low-privileged users who may be granted contributor roles during normal site operations. No public exploit code or active exploitation has been confirmed at the time of analysis.
The Contact Form Entries plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file validation on the 'view_page' function in versions up to, and including, 1.3.2. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. This Unrestricted File Upload vulnerability could allow attackers to upload malicious files that can be executed on the server.
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks Integration for HubSpot and Contact Form 7, WPForms, Elementor, Ninja Forms.2.8. Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability in CRM Perks Contact Form Entries contact-form-entries.3.0. Rated high severity (CVSS 8.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
We need to generate a JSON object with the specified fields, synthesizing all provided data about CVE-2026-14870. First, parse the input: CVE ID: CVE-2026-14870 Description: The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.3 does not properly sanitise and escape a parameter before reflecting it back in an admin page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. CVSS Score: 7.1 CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L CWE: CWE-79 EPSS: 0.15% (percentile 5%) POC/Exploit: Publicly available Patch: Available from vendor Reported by: WPScan CPE: cpe:2.3:a:unknown:database_for_contact_form_7,_wpforms,_elementor_forms:*:*:*:*:*:*:*:* Tags: XSS, WordPress, Database For Contact Form 7 Wpforms Elementor Forms SSVC: Exploitation: poc, Automatable: no, Technical Impact: partial ENISA EUVD ID: EUVD-2026-49701 Affected versions (EUVD): ["Database for Contact Form 7, WPforms, Elementor forms 0 <1.5.3"] References: [cveorg] (exploit) https://wpscan.com/vulnerability/d574b78c-df04-4dab-bd33-e3a22ff51918/ [euvd] (advisory) https://nvd.nist.gov/vuln/detail/CVE-2026-14870 Now, construct each field as a paragraph string. product_name: The plugin name is "Database for Contact Form 7, WPforms, Elementor forms". So product_name: "Database for Contact Form 7, WPforms, Elementor forms" – but that's long, but permissible as a product name. The task says "1-3 words ONLY." That's problematic because the product name is longer. I need to pick a short name. The plugin's main purpose: it's a database plugin for those form plugins. Maybe "WordPress Forms Database" or "Database for CF7, WPforms, Elementor Forms"? But I must keep it 1-3 words. The plugin name as per WPScan: "Database for Contact Form 7, WPforms, Elementor forms". I could shorten to "Database for Contact Form 7, WPforms, Elementor forms plugin"? No, that's too long. The instruction says: "product_name": "1-3 wor
Arbitrary file deletion in the Database for Contact Form 7, WPforms, Elementor forms WordPress plugin (versions ≤1.5.1) allows remote unauthenticated attackers to poison form entries with traversal payloads that, when later viewed by an administrator, delete arbitrary server files and can be escalated to remote code execution by removing wp-config.php. Reported by Wordfence with publicly available exploit code exists via the Wordfence advisory; no public exploit identified at time of analysis as weaponized in-the-wild attacks, and the issue is not in CISA KEV.
SQL injection in the Database for Contact Form 7, WPforms, Elementor forms WordPress plugin (versions before 1.5.5) exposes the underlying WordPress database to unauthorized read access by any user holding a specific capability that defaults to administrators but can be explicitly delegated to lower-privileged roles. The CVSS scope-change rating (S:C/C:H) reflects that a successful injection reaches beyond the plugin itself into the shared WordPress database, potentially exposing all stored form submissions, user data, and other sensitive records. Publicly available exploit code exists per WPScan; however, EPSS at 0.16% (5th percentile) and absence from CISA KEV indicate no confirmed widespread active exploitation at time of analysis.
PHP object injection in the 'Database for Contact Form 7, WPforms, Elementor forms' WordPress plugin (all versions before 1.5.2) permits unauthenticated attackers to embed malicious serialized PHP objects via the entry-editor file-field path, which are instantiated server-side when an administrator views the stored form entry. This is an incomplete remediation of two prior CVEs (CVE-2025-7384 and CVE-2026-2599) - earlier patches hardened other deserialization paths within the same plugin while this specific code route was overlooked. A publicly available exploit exists; no active exploitation is confirmed by CISA KEV at time of analysis.
Arbitrary file copy in the Database for Contact Form 7, WPforms, Elementor Forms WordPress plugin (versions ≤ 1.5.1) exposes any file readable by the PHP process to unauthenticated network attackers. The `create_entry_el()` function accepts attacker-controlled POST data as a file path and passes it directly to PHP's `copy()`, which transparently accepts both local filesystem paths and remote URLs - enabling server file exfiltration or remote resource staging. Exploitation requires Elementor Pro to be installed and active alongside the vulnerable plugin; no public exploit or CISA KEV listing has been identified at time of analysis, though the unauthenticated network vector and high confidentiality impact make this a credible priority for mixed Elementor Pro deployments.
Authenticated attackers with Contributor-level access or above can extract all form submissions from the Database for Contact Form 7, WPforms, Elementor Forms WordPress plugin (versions up to 1.4.9) via a missing capability check in the entries_shortcode() function, exposing names, emails, phone numbers, and other sensitive form data. The vulnerability requires existing WordPress user credentials but no administrative privileges, making it accessible to low-privileged users who may be granted contributor roles during normal site operations. No public exploit code or active exploitation has been confirmed at the time of analysis.
The Contact Form Entries plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file validation on the 'view_page' function in versions up to, and including, 1.3.2. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. This Unrestricted File Upload vulnerability could allow attackers to upload malicious files that can be executed on the server.
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks Integration for HubSpot and Contact Form 7, WPForms, Elementor, Ninja Forms.2.8. Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability in CRM Perks Contact Form Entries contact-form-entries.3.0. Rated high severity (CVSS 8.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.