Skip to content
Sign in
7.1 High

CVE-2026-14870 The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.3 does not properly sanitise and…

Description

The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.3 does not properly sanitise and escape a parameter before reflecting it back in an admin page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.

Affected products and versions

Product Affected versions Fixed in
Database for Contact Form 7, WPforms, Elementor forms 1.5 earliest → < 1.5.3 1.5.3

Other CVEs of Database for Contact Form 7, WPforms, Elementor forms

The 3 CVEs of Database for Contact Form 7, WPforms, Elementor forms →
CVE-2026-14872 The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.5 does not properly sanitise and… 6.8 Medium CVE-2026-12081 The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.2 does not restrict the PHP… 5.0 Medium
Track this CVE