CVE-2026-14870

Database for Contact Form 7, WPforms, Elementor forms < 1.5.3 - Reflected XSS via form_id

The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.3 does not properly sanitise and escape a parameter before reflecting it back in an admin page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.

We have discovered 6,337 live websites that are affected by CVE-2026-14870.

Run a Free Instant Scan



Affected Software

Product  WPForms
Category Form Builders
Vulnerable Domains6,337 live websites (1.33% of WPForms install base)
Vulnerable Versions
  • from 0 through 1.5.3
Vulnerable Versions Count61 versions ( 26% of all versions)


Common Weakness Enumeration

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')



Details

  • Published - Jul 28, 2026
  • Updated - Jul 28, 2026

Credits

  • Luca Jungnickel (finder)
  • WPScan (coordinator)

Website Distribution by Country

Number of websites using CVE-2026-14870
United States2,272 websites


Germany487 websites
France329 websites
GB325 websites
Italy279 websites
Spain202 websites
Netherlands176 websites
Russia164 websites
Canada155 websites
Australia151 websites

Website Distribution by TLD

Number of websites using CVE-2026-14870
.com2,979 websites
.org333 websites
.de243 websites
.co.uk191 websites
.it172 websites
.net162 websites
.fr145 websites
.nl144 websites
.com.au137 websites
.ru127 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2026-14870

Top websites that are affected by CVE-2026-14870. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
***********.net Singapore**,***
*************.**.uk GB**,***
************.fr France**,***
***.**.th United States***,***
********.com United States***,***
*********.net United States***,***
******************.com United States***,***
***************.com United States***,***
**************.org United States***,***
*****.onl United States***,***
See full domain list

FAQ

CVE-2026-14870 is Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in WPForms
A total of 6,337 websites have been identified as vulnerable to CVE-2026-14870, based on global website indexing conducted by WebTechSurvey.
The WPForms is affected by the CVE-2026-14870 vulnerability.
WPForms versions up to 1.5.3 are vulnerable to CVE-2026-14870.
CVE-2026-14870 is resolved in version 1.5.3 of WPForms.