Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-08-26
Database for Contact Form 7, WPforms, Elementor forms - SQL Injection (CVE-2026-14872)
The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL Injection exploitable by users granted a specific capability which is limited to administrators by default but can be delegated to lower privileged roles.
PLUGIN
Database for Contact Form 7, WPforms, Elementor forms
CVE-2026-14872
Risk Score
Threat Entry
Updated 2026-07-28
Database for Contact Form 7, WPforms, Elementor forms - Cross-Site Scripting (XSS) (CVE-2026-14870)
The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.3 does not properly sanitise and escape a parameter before reflecting it back in an admin page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
PLUGIN
Database for Contact Form 7, WPforms, Elementor forms
CVE-2026-14870
Risk Score
Threat Entry
Updated 2026-07-13
Database for Contact Form 7, WPforms, Elementor forms - PHP Object Injection (CVE-2026-12081)
The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.2 does not restrict the PHP classes allowed when unserializing an attacker-supplied form-field value, allowing unauthenticated users to inject arbitrary PHP objects that are instantiated when an administrator views the stored entry. This is an incomplete fix of CVE-2025-7384 and CVE-2026-2599, whose deserialization paths were hardened while the entry-editor file-field path was missed.
PLUGIN
Database for Contact Form 7, WPforms, Elementor forms
CVE-2026-12081
Risk Score
Threat Entry
Updated 2026-06-17
Database for Contact Form 7, WPforms, Elementor forms - Cross-Site Scripting (XSS) (CVE-2024-3715)
The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.3.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Database for Contact Form 7, WPforms, Elementor forms
CVE-2024-3715
Risk Score