EUVD-2026-93273
GHSA-c43r-g4mr-hfvq
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Network-reachable unauthenticated injection (AV:N/PR:N) requiring victim to render the payload (UI:R), with scope change and low partial impacts typical of plugin XSS executing in the browser.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated Cross Site Scripting (XSS) in ARForms <= 7.1.2 versions.
AnalysisAI
Cross-site scripting in the ARForms WordPress plugin versions up to and including 7.1.2 allows unauthenticated remote attackers to inject script through plugin-handled form input that is rendered without proper output encoding (CVSS 7.1, CWE-79). Exploitation is not zero-click: per the CVSS vector UI:R, a victim must load or view the affected page, and meaningful impact typically depends on the victim being an authenticated user or administrator whose session can be abused. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation targets the ARForms WordPress plugin at version 7.1.2 or earlier and requires an attacker to inject an XSS payload through a plugin-handled input (form field or request parameter) that is rendered without proper output encoding. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a medium-to-high severity stored/reflected Cross-Site Scripting flaw (CVSS 7.1, CWE-79) in the ARForms WordPress plugin. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch identified at time of analysis, so the primary action is to monitor the Patchstack advisory and ReputeInfosystems for an update and upgrade the ARForms plugin beyond the affected 7.1.2 range as soon as a fixed release is published; until then, treat sites running ARForms <= 7.1.2 as vulnerable. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all WordPress sites using ARForms plugin versions up to and including 7.1.2 and determine business criticality; if feasible, temporarily disable or remove the plugin on externally accessible sites and restrict administrative access to trusted networks. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
The ARForms - Premium WordPress Form Builder Plugin WordPress plugin before 6.6 allows unauthenticated users to modify u
The ARForms - Premium WordPress Form Builder Plugin WordPress plugin before 6.4.1 does not properly escape user-controll
The ARForms - Premium WordPress Form Builder Plugin WordPress plugin before 6.6 does not sanitise and escape some of its
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in reputeinfosystems
Path Traversal: '.../...//' vulnerability in reputeinfosystems ARForms arforms allows Path Traversal.4.1. Rated high sev
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in reputeinfosystems ARForm
In the ARforms plugin 3.7.1 for WordPress, arf_delete_file in arformcontroller.php allows unauthenticated deletion of an
Stored cross-site scripting in the ARforms WordPress form-builder plugin (all versions through 7.2.1) lets unauthenticat
Stored cross-site scripting in the ARForms WordPress plugin (versions ≤7.1.3) allows unauthenticated remote attackers to
Missing Authorization vulnerability in reputeinfosystems ARForms arforms.4. Rated high severity (CVSS 7.1), this vulnera
Missing Authorization vulnerability in reputeinfosystems ARForms arforms.4. Rated high severity (CVSS 7.1), this vulnera
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in reputeinfosystems
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today