sales@hackhalt.com
Free Download

Live Vulnerability Intelligence

Threat Database

Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.

Total19
Critical1
High14
Medium4
Reset
Showing 1-19 of 19 records
Threat Entry Updated 2026-11-11

ARforms - Security Vulnerability (CVE-2026-12427)

The ARforms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'description' parameter in all versions up to, and including, 7.2.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload is deserialized via maybe_unserialize() when an administrator views the affected entry; if the attacker's array contains a 'referrer' key, the attacker-controlled page_url and http_referrer values are used as-is and rendered unescaped into…

PLUGIN ARforms

CVE-2026-12427

HIGH CVSS 7.2 2026-11-11
Open Full Technical Breakdown
Threat Entry Updated 2026-11-11

ARforms - Security Vulnerability (CVE-2026-12424)

The ARforms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Referer Header in all versions up to, and including, 7.2.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The arf_save_incomplete_form_data() AJAX handler is registered with wp_ajax_nopriv_, meaning unauthenticated attackers can store a malicious payload by submitting a partial form entry with a forged Referer header, with no authentication required at any step.

PLUGIN ARforms

CVE-2026-12424

HIGH CVSS 7.2 2026-11-11
Open Full Technical Breakdown
Threat Entry Updated 2026-11-13

ARForms - Security Vulnerability (CVE-2026-111190)

The ARForms plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 7.2.4 via its form file-upload handler. The name of the stored file is taken from an attacker-controlled request header and is not adequately restricted to safe file types, and the plugin's file-type and content-safety checks can be evaded, allowing files that contain executable PHP code to be written to a publicly accessible directory. This makes it possible for unauthenticated attackers to upload malicious files to the affected site's server, which may make…

PLUGIN ARForms

CVE-2026-111190

HIGH CVSS 8.1 2026-11-11
Open Full Technical Breakdown
Threat Entry Updated 2026-07-23

Arforms - Cross-Site Scripting (XSS) (CVE-2026-12421)

The ARforms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'password' Field Values in all versions up to, and including, 7.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Arforms

CVE-2026-12421

HIGH CVSS 7.2 2026-07-23
Open Full Technical Breakdown
Threat Entry Updated 2026-06-25

ARForms - Cross-Site Scripting (XSS) (CVE-2026-3652)

The ARForms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `value` parameter of the `arf_save_incomplete_form_data` AJAX action in all versions up to, and including, 7.1.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that will execute whenever an administrator views the "Partial Filled Form Entries" page in the ARForms dashboard.

PLUGIN ARForms

CVE-2026-3652

HIGH CVSS 7.2 2026-06-24
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Arforms - Cross-Site Scripting (XSS) (CVE-2024-10504)

The Contact Form, Survey, Quiz & Popup Form Builder WordPress plugin before 1.7.1 does not sanitise and escape some parameters when outputting them in the page, which could allow unauthenticated users to perform Cross-Site Scripting attacks.

PLUGIN Arforms

CVE-2024-10504

MEDIUM CVSS 5.4 2025-05-15
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Arforms - Security Vulnerability (CVE-2024-4620)

The ARForms - Premium WordPress Form Builder Plugin WordPress plugin before 6.6 allows unauthenticated users to modify uploaded files in such a way that PHP code can be uploaded when an upload file input is included on a form

PLUGIN Arforms

CVE-2024-4620

CRITICAL CVSS 9.8 2024-06-07
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Arforms - Cross-Site Scripting (XSS) (CVE-2024-4621)

The ARForms - Premium WordPress Form Builder Plugin WordPress plugin before 6.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

PLUGIN Arforms

CVE-2024-4621

MEDIUM CVSS 4.8 2024-06-07
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Arforms - SQL Injection (CVE-2024-32706)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in reputeinfosystems ARForms arforms.This issue affects ARForms: from n/a through

PLUGIN Arforms

CVE-2024-32706

HIGH CVSS 8.5 2024-04-24
Open Full Technical Breakdown

WordPress security that blocks attacks before they land.

sales@hackhalt.com

Product

Resources

Company

© Hack Halt Inc. All rights reserved.