EUVD-2026-40109
GHSA-2gv4-h2pg-hjh9
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Network-reachable reflected XSS needs no auth (PR:N) but requires victim click (UI:R); scope changes to the browser (S:C) with limited confidentiality/integrity and no genuine availability impact (A:N).
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Lifecycle Timeline
1DescriptionCVE.org
Unauthenticated Cross Site Scripting (XSS) in ARForms <= 7.1.2 versions.
AnalysisAI
Reflected cross-site scripting in the ARForms WordPress plugin (versions 7.1.2 and earlier) lets an unauthenticated remote attacker inject script into a victim's browser when the victim clicks a crafted link. Because the CVSS scope is changed (S:C), successful injection can affect the broader WordPress session/DOM context rather than only the form. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Technical ContextAI
ARForms (vendor Repute Infosystems, CPE cpe:2.3:a:repute_infosystems:arforms) is a commercial drag-and-drop form-builder plugin for WordPress used to create contact, survey, and lead-capture forms. The flaw is classified CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning attacker-controlled input is reflected back into an HTTP response without proper output encoding or contextual sanitization. In the reflected variant, the malicious payload is delivered in a request parameter and echoed into the page, so it executes in the context of the WordPress site origin in the victim's browser.
RemediationAI
No vendor-released patch version was identified in the available data; the primary action is to upgrade to the first ARForms release published after 7.1.2 (verify the exact fixed version directly against the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/arforms/vulnerability/wordpress-arforms-plugin-7-1-2-reflected-cross-site-scripting-xss-vulnerability and the WordPress.org plugin changelog before deploying). Until a confirmed fixed build is applied, compensating controls include deploying a WAF or virtual patch (Patchstack's own rules cover this) to filter reflected XSS payloads on the affected endpoint, adding a restrictive Content-Security-Policy that disallows inline script to blunt payload execution (side effect: may break legitimate inline scripts and require tuning), and disabling or restricting public access to ARForms-rendered pages if they are not business-critical (side effect: removes form functionality for users). User awareness against clicking unsolicited links targeting the site also reduces the UI:R-dependent exploitation window.
The ARForms - Premium WordPress Form Builder Plugin WordPress plugin before 6.6 allows unauthenticated users to modify u
The ARForms - Premium WordPress Form Builder Plugin WordPress plugin before 6.4.1 does not properly escape user-controll
The ARForms - Premium WordPress Form Builder Plugin WordPress plugin before 6.6 does not sanitise and escape some of its
Path Traversal: '.../...//' vulnerability in reputeinfosystems ARForms arforms allows Path Traversal.4.1. Rated high sev
In the ARforms plugin 3.7.1 for WordPress, arf_delete_file in arformcontroller.php allows unauthenticated deletion of an
Stored cross-site scripting in the ARforms WordPress form-builder plugin (all versions through 7.2.1) lets unauthenticat
Stored cross-site scripting in the ARForms WordPress plugin (versions ≤7.1.3) allows unauthenticated remote attackers to
The Contact Form, Survey, Quiz & Popup Form Builder WordPress plugin before 1.7.1 does not sanitise and escape some para
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today