What is the CVSS score of CVE-2026-3652?

CVE-2026-3652 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Which versions of ARForms are affected by CVE-2026-3652?

The ARForms WordPress plugin (versions 7.1.3 and earlier) contains a stored cross-site scripting vulnerability that enables unauthenticated attackers to inject malicious code into administrator…

How to fix or mitigate CVE-2026-3652?

WITHIN 24 HOURS: Inventory all WordPress instances running ARForms version 7.1.3 or lower; immediately deactivate the plugin across all affected systems; audit administrator login logs for unauthorized access. WITHIN 7 DAYS: Deploy WAF rules to block requests to the arf_save_incomplete_form_data endpoint with script injection payloads; reset credentials on all WordPress administrator accounts; patch WordPress core and all plugins. WITHIN 30 DAYS: Migrate to alternative form plugins (Gravity Forms, WPForms, or Formidable Forms); establish alert monitoring for Wordfence security notifications; do not reactivate ARForms until vendor-released patch is available.

ARForms CVE-2026-3652

EUVD-2026-38644 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-06-24 Wordfence

GHSA-74c3-6w2v-rcqg

XSS WordPress Arforms

7.2

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

6.1 MEDIUM

Unauthenticated network injection (AV:N/AC:L/PR:N), but execution requires an admin to view the entries page (UI:R); scope changes to admin session with limited C/I impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 24, 2026 - 03:43 vuln.today

CVE Published

Jun 24, 2026 - 02:29 cve.org

HIGH 7.2

DescriptionCVE.org

The ARForms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the value parameter of the arf_save_incomplete_form_data AJAX action in all versions up to, and including, 7.1.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that will execute whenever an administrator views the "Partial Filled Form Entries" page in the ARForms dashboard.

Articles & Coverage 1

News 18 New WordPress Vulnerabilities - 2 Critical, 6 With POC Jun 25, 2026

AnalysisAI

Stored cross-site scripting in the ARForms WordPress plugin (versions ≤7.1.3) allows unauthenticated remote attackers to inject arbitrary JavaScript via the value parameter of the arf_save_incomplete_form_data AJAX endpoint, with the payload executing in an administrator's browser when they view the Partial Filled Form Entries dashboard page. No public exploit identified at time of analysis, though Wordfence's disclosure provides enough technical detail to reproduce the injection. Successful exploitation typically leads to admin account takeover and full WordPress site compromise.

Technical ContextAI

ARForms is a commercial drag-and-drop form-builder plugin for WordPress distributed via Envato CodeCanyon. The flaw is a textbook CWE-79 (Improper Neutralization of Input During Web Page Generation) in the partial-form-save feature: the arf_save_incomplete_form_data AJAX action accepts a value parameter from anonymous visitors and persists it without sanitization (e.g., sanitize_text_field/wp_kses), and then renders it without output escaping (e.g., esc_html/esc_attr) on the administrative Partial Filled Form Entries listing. The CPE cpe:2.3:a:n/a:arforms:*:*:*:*:*:*:*:* covers all plugin versions through 7.1.3.

RemediationAI

No vendor-released patch identified at time of analysis - the references include only the Wordfence advisory and the CodeCanyon product page, with no fixed-version designation. Site operators should monitor the CodeCanyon listing and the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/b6ca5856-9010-4bb3-a024-92b3b4d500b4) for an update past 7.1.3 and upgrade as soon as one is published. Until a fix ships, compensating controls include blocking the arf_save_incomplete_form_data AJAX action at the WAF/edge (e.g., a ModSecurity or Wordfence rule matching action=arf_save_incomplete_form_data with HTML/JS metacharacters in value), disabling the partial-entry feature in ARForms settings if not required (loses incomplete-submission recovery), restricting access to /wp-admin/admin-ajax.php for the affected action by IP allowlist where feasible, and instructing administrators to avoid the Partial Filled Form Entries page until patched. Enabling Wordfence's premium ruleset will likely add virtual-patch coverage automatically.