Stored Cross-Site Scripting Vulnerability in ARforms Plugin for WordPress
CVE-2026-12424

7.2HIGH

Key Information:

Vendor

WordPress
Status
Arforms
Vendor
CVE Published:
11 November 2026

What is CVE-2026-12424?

The ARforms plugin for WordPress is susceptible to a Stored Cross-Site Scripting vulnerability due to inadequate input sanitization and output escaping. This issue allows unauthenticated attackers to inject malicious scripts into web pages, which are executed when users access these compromised pages. The vulnerability can be exploited via the arf_save_incomplete_form_data() AJAX handler, which does not require authentication and is accessible by unauthenticated users. By submitting a partial form with a manipulated Referer header, attackers can store and execute harmful payloads.

Affected Version(s)

ARforms 0 <= 7.2.4

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://www.arformsplugin.com/documentation/changelog/

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Huynh Pham Thanh Luc
.