ARforms vulnerabilities
We track 5 vulnerabilities in ARforms products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on November 11, 2026.
Latest ARforms vulnerabilities
- 7.2 High severity
ARforms: Improper Neutralization of Input During Web Page Generation
The ARforms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'description' parameter in all versions up to, and including, 7.2.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated att
- 7.2 High severity
ARforms: Improper Neutralization of Input During Web Page Generation
The ARforms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Referer Header in all versions up to, and including, 7.2.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inj
- 8.1 High severity
ARforms: Unrestricted Upload of File with Dangerous Type
The ARForms plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 7.2.4 via its form file-upload handler. The name of the stored file is taken from an attacker-controlled request header and is not adequately restrict
- 7.2 High severity
ARforms: Improper Neutralization of Input During Web Page Generation
The ARforms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'password' Field Values in all versions up to, and including, 7.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attacke
- 7.2 High severity
ARforms: Improper Neutralization of Input During Web Page Generation
The ARForms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `value` parameter of the `arf_save_incomplete_form_data` AJAX action in all versions up to, and including, 7.1.3 due to insufficient input sanitization and output escaping. T