What is the CVSS score of CVE-2026-57338?

CVE-2026-57338 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.1%.

Which versions of ARForms are affected by CVE-2026-57338?

ARForms WordPress plugin versions 7.1.2 and earlier contain an unauthenticated reflected XSS vulnerability (CVE-2026-57338); no public exploit identified at time of analysis.

How to fix or mitigate CVE-2026-57338?

Within 24 hours: Conduct inventory of all WordPress installations running ARForms plugin and identify affected versions. Within 7 days: Deploy Web Application Firewall (WAF) rules blocking XSS patterns in form parameters; consider disabling the plugin if not business-critical. Within 30 days: Upgrade to patched version when vendor releases it, or migrate to alternative form management plugin; implement recurring plugin vulnerability scanning.

ARForms CVE-2026-57338

EUVD-2026-40109 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-06-29 Patchstack

GHSA-2gv4-h2pg-hjh9

WordPress XSS Arforms Wordpress Plugin Repute Infosystems

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

6.1 MEDIUM

Network-reachable reflected XSS needs no auth (PR:N) but requires victim click (UI:R); scope changes to the browser (S:C) with limited confidentiality/integrity and no genuine availability impact (A:N).

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 29, 2026 - 15:18 vuln.today

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in ARForms <= 7.1.2 versions.

AnalysisAI

Reflected cross-site scripting in the ARForms WordPress plugin (versions 7.1.2 and earlier) lets an unauthenticated remote attacker inject script into a victim's browser when the victim clicks a crafted link. Because the CVSS scope is changed (S:C), successful injection can affect the broader WordPress session/DOM context rather than only the form. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Technical ContextAI

ARForms (vendor Repute Infosystems, CPE cpe:2.3:a:repute_infosystems:arforms) is a commercial drag-and-drop form-builder plugin for WordPress used to create contact, survey, and lead-capture forms. The flaw is classified CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning attacker-controlled input is reflected back into an HTTP response without proper output encoding or contextual sanitization. In the reflected variant, the malicious payload is delivered in a request parameter and echoed into the page, so it executes in the context of the WordPress site origin in the victim's browser.

RemediationAI

No vendor-released patch version was identified in the available data; the primary action is to upgrade to the first ARForms release published after 7.1.2 (verify the exact fixed version directly against the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/arforms/vulnerability/wordpress-arforms-plugin-7-1-2-reflected-cross-site-scripting-xss-vulnerability and the WordPress.org plugin changelog before deploying). Until a confirmed fixed build is applied, compensating controls include deploying a WAF or virtual patch (Patchstack's own rules cover this) to filter reflected XSS payloads on the affected endpoint, adding a restrictive Content-Security-Policy that disallows inline script to blunt payload execution (side effect: may break legitimate inline scripts and require tuning), and disabling or restricting public access to ARForms-rendered pages if they are not business-critical (side effect: removes form functionality for users). User awareness against clicking unsolicited links targeting the site also reduces the UI:R-dependent exploitation window.