ARforms (<= 7.2.4) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/arforms--7.2.4/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 11 Nov 2026 13:54:25 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgARforms: Stored Cross-Site Scripting (CVE-2026-12424)https://feed.craftedsignal.io/briefs/2026-11-arforms-xss-cve-2026-12424/Wed, 11 Nov 2026 13:54:25 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-arforms-xss-cve-2026-12424/The ARforms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Referer Header in all versions up to, and including, 7.2.4 due to insufficient input sanitization and output escaping.The ARforms plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the Referer header in all versions up to, and including, 7.2.4. The vulnerability arises from insufficient input sanitization and output escaping.

The arf_save_incomplete_form_data() AJAX handler is registered with wp_ajax_nopriv_, which allows unauthenticated attackers to store a malicious payload by submitting a partial form entry with a forged Referer header. This allows for the injection of arbitrary web scripts that execute whenever a user accesses an injected page.

]]>highadvisory