Database for Contact Form 7, WPforms, Elementor forms < 1.5.3 – Reflected XSS via form_id | CVE 2026-14870

Description

The plugin does not properly sanitise and escape a parameter before reflecting it back in an admin page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.

Proof of Concept

This is a Reflected Cross-Site Scripting affecting logged-in administrators (the affected page is admin-only).

1. Craft the following URL for the target site. The form_id value decodes to: x';alert(1)//

   https://victim.example/wp-admin/admin.php?page=vxcf_leads&form_id=x%27%3Balert%281%29//

2. Send the link to a site administrator and get them to open it while logged in to wp-admin.

3. The form_id value is reflected, unescaped for a JavaScript-string context, into an inline <script> block on the leads page:

   var vx_print_link='...&form_id=x';alert(1)//';

   The injected value closes the JS string literal and executes alert(1) in the administrator's browser. Arbitrary JavaScript runs in the admin session.