CVE-2026-14870

The vulnerability affects the Database for Contact Form 7, WPforms, and Elementor forms plugins for WordPress prior to version 1.5.3, allowing for reflected cross-site scripting due to inadequate sanitization of parameters on an admin page. This flaw poses a significant risk, particularly to high-privilege users like administrators, as it could be exploited to execute malicious scripts in their browsers. WordPress site administrators using these plugins should prioritize updating to the latest version to mitigate this security risk.