VulnSocial

CVE-2026-14870Disclosure

LOWCVSS 7.1 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.3 does not properly sanitise and escape a parameter before reflecting it back in an admin page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-79

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 2 signals
  • Disclosure: 1 classified signal
  • Peaked 1d ago at 1 mentions (2026-07-28); latest day: 1
  • 2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-07-28: 1Mentions · 2026-10-22: 1Patch / Workaround · 2026-10-22: 1Technical Details · 2026-07-28: 1Technical Details · 2026-10-22: 107-2810-22
Signal classification2 categories
Disclosure
150.0%
Patch
150.0%
Referenced assets2 URLs
Classification over time
DateTotalLabels
2026-07-281
Disclosure1
2026-10-221
Patch1
Full discourse2 posts
  • pdnuclei-bot@pdnuclei_bot
    Patch

    🚨 CVE-2026-14870 - high 🚨 WordPress Database for Contact Form 7, WPforms, Elementor forms < 1.5.3 - Cross-Site Scripting > Database for Contact Form 7, WPforms, Elementor forms WordPress plugin < 1.5.3 contai... 👾 https://cloud.projectdiscovery.io/library/CVE-2026-14870 @p...

    Post summary

    The tweet announces CVE-2026-14870 as a high-severity XSS vulnerability affecting WordPress form plugins versions prior to 1.5.3, with a link to a vulnerability database for further details.

    00001203
    1.4K followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    Disclosure

    CVE-2026-14870 Reflected Cross-Site Scripting in Database for Contact Form 7 WordPress Plugin Before 1.5.3 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-14870

    Post summary

    The text announces CVE-2026-14870, a reflected XSS flaw in the Contact Form 7 WordPress plugin affecting versions before 1.5.3.

    0000087
    4.1K followersView on X

Explore more

Back to dashboard