Vendor

ARforms

1 brief RSS

ARforms WordPress Plugin Vulnerable to Stored Cross-Site Scripting via 'password' Field (CVE-2026-12421)

An insufficient input sanitization and output escaping vulnerability (CVE-2026-12421) in the ARforms plugin for WordPress, affecting versions up to and including 7.2.1, allows unauthenticated attackers to inject arbitrary web scripts via the 'password' field, leading to Stored Cross-Site Scripting (XSS) when a user accesses an injected page.

ARforms wordpress xss plugin web-application vulnerability

2t 1c 2h ago