ARforms: Stored Cross-Site Scripting (CVE-2026-12424)
The ARforms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Referer Header in all versions up to, and including, 7.2.4 due to insufficient input sanitization and output escaping.
CVE search metadata
CVE search record: CVE-2026-12424. Severity: high. CVSS: 7.2. KEV: no. Product: ARforms (<= 7.2.4). Brief: ARforms: Stored Cross-Site Scripting (CVE-2026-12424). Brief link: https://feed.craftedsignal.io/briefs/2026-11-arforms-xss-cve-2026-12424/
Triage facts
Revision 1- Applicability
- ARforms (<= 7.2.4)
- Evidence
- Unknown
- Severity
- High
- Sources
- 2 public sources
- Freshness
- Revision 1Nov 11, 13:54 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
The ARforms plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the Referer header in all versions up to, and including, 7.2.4. The vulnerability arises from insufficient input sanitization and output escaping.
The arf_save_incomplete_form_data() AJAX handler is registered with wp_ajax_nopriv_, which allows unauthenticated attackers to store a malicious payload by submitting a partial form entry with a forged Referer header. This allows for the injection of arbitrary web scripts that execute whenever a user accesses an injected page.