What is the CVSS score of EUVD-2026-47937?

EUVD-2026-47937 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.3%.

Which versions of ARforms are affected by EUVD-2026-47937?

WordPress sites running ARforms form-builder plugin (all versions through 7.2.1) are vulnerable to stored cross-site scripting attacks that allow unauthenticated attackers to inject malicious code…

How to fix or mitigate EUVD-2026-47937?

Within 24 hours: Audit all WordPress installations for ARforms plugin versions through 7.2.1; document affected systems and request patched version availability from ARforms vendor. Within 7 days: For systems without a released vendor patch, either disable the ARforms plugin entirely or migrate to an alternative hardened form-builder solution; deploy compensating controls listed below. Within 30 days: Complete full remediation by upgrading to a patched ARforms version (if vendor releases one) or permanently replacing the plugin with a secured alternative such as WPForms or Gravity Forms.

ARforms EUVD-2026-47937

| CVE-2026-12421 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-23 Wordfence

GHSA-359c-qmw4-f7gf

WordPress XSS N A Arforms Wordpress Plugin

7.2

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

6.1 MEDIUM

Unauthenticated remote injection (PR:N, AV:N, AC:L) with cross-context script execution (S:C, C:L/I:L), but UI:R because a victim must load the injected page for the stored payload to fire.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 08:16 vuln.today

CVE Published

Jul 23, 2026 - 06:52 cve.org

HIGH 7.2

DescriptionCVE.org

The ARforms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'password' Field Values in all versions up to, and including, 7.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored cross-site scripting in the ARforms WordPress form-builder plugin (all versions through 7.2.1) lets unauthenticated attackers persist arbitrary JavaScript through submitted 'password' field values, which later executes in the browser of any user who loads the affected page. Because the injection point is a public-facing form and no authentication is required, the flaw is well-suited to opportunistic, automated abuse against WordPress sites running the plugin. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the CVSS 7.2 (scope-changed) rating and unauthenticated vector make it a meaningful patch priority.

Technical ContextAI

ARforms is a commercial drag-and-drop form-builder plugin for WordPress used to create contact, registration, and login-style forms. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation): user-supplied values for form 'password' fields are stored without sufficient input sanitization and rendered back without adequate output escaping. The referenced source location, arrecordhelper.php around line 704 (the record/entry helper that assembles stored submissions for display), is where submitted field values are handled, so the payload is persisted server-side and reflected into HTML - typically when submissions are rendered in an entry/preview context. The single CPE provided, cpe:2.3:a:n/a:arforms:*:*:*:*:*:*:*:*, is unbounded on version and confirms only the product family, consistent with the 'all versions up to and including 7.2.1' statement.

RemediationAI

No vendor-released patch version was identified in the provided data, so update ARforms to the latest available release above 7.2.1 as soon as the vendor publishes a fix, and consult the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/19e48549-8a28-4626-b0b5-b781cd01fa5b?source=cve) for the confirmed patched version before assuming remediation. As interim compensating controls: deploy a WAF or the Wordfence firewall with XSS rules to filter script payloads in form submissions (trade-off: rule-based filtering can be bypassed and may block legitimate special characters); restrict or disable any ARforms forms that expose a password field, or remove password fields from public forms where not essential (trade-off: reduces form functionality); and limit who can view stored form entries in wp-admin to reduce the chance a payload fires in a privileged session (trade-off: operational overhead for teams that triage submissions). Avoid inventing a fix version - cite only the version the vendor advisory confirms.