My current Zenphoto version is 1.2.7, and tried to upgrade to latest version 1.4.14.
(The old one is not compatible with PHP7.0)
After following the instruction of upgrade new version, the page asked me to enter MySQL info but not working.
The error message is "An attempt at cross site reference forgery has been blocked."

It is not recommended to upgrade from such very old versions directly.

I cannot answer the actual issue but try editing the config file within /zp-data manually with the correct credentials.

Can you suggest if I would like to upgrade from other version, which version is better before I upgrade to the latest one.

Sorry, you have to try step by step as suggested on our installation page. I did update older versions directly but not every site is the same.

We don't really test direct updates from such several year old versions. You should update frequently anyway ;-)