/Vulnerability Library

WordPress Database for Contact Form 7, WPforms, Elementor forms < 1.5.3 - Cross-Site Scripting

CVE-2026-14870
Verified

Description

Database for Contact Form 7, WPforms, Elementor forms WordPress plugin < 1.5.3 contains a reflected XSS caused by improper sanitization and escaping of a parameter in an admin page, letting attackers execute scripts against admin users, exploit requires admin access.

Severity

High

CVSS Score

7.1

Exploit Probability

0%

Affected Product

contact-form-entries

Published Date

October 21, 2026

Template Author

anirbala98

CVE-2026-14870.yaml
7.1Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
CVE ID:
cve-2026-14870
CWE ID:
cwe-79

References

https://wpscan.com/vulnerability/d574b78c-df04-4dab-bd33-e3a22ff51918/https://wordpress.org/plugins/contact-form-entries/https://nvd.nist.gov/vuln/detail/CVE-2026-14870

Remediation Steps

Upgrade to version 1.5.3 or later.