304 matches found
ArForms < 6.6 - Remote Code Execution
The ARForms - Premium WordPress Form Builder Plugin WordPress plugin before 6.6 allows unauthenticated users to modify uploaded files in such a way that PHP code can be uploaded when an upload file input is included on a form id: CVE-2024-4620 info: name: ArForms 6.6 - Remote Code Execution autho...
CVE-2026-12424
The ARforms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Referer Header in all versions up to, and including, 7.2.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages th...
CVE-2026-12427
The ARforms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'description' parameter in all versions up to, and including, 7.2.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web script...
CVE-2026-111190
The ARForms plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 7.2.4 via its form file-upload handler. The name of the stored file is taken from an attacker-controlled request header and is not adequately restricted to safe file types, and the plugin...
CVE-2026-111190 ARForms <= 7.2.4 - Unauthenticated Arbitrary File Upload to Remote Code Execution via X-FILENAME Header
The ARForms plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 7.2.4 via its form file-upload handler. The name of the stored file is taken from an attacker-controlled request header and is not adequately restricted to safe file types, and the plugin...
EUVD-2026-123272
The ARForms plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 7.2.4 via its form file-upload handler. The name of the stored file is taken from an attacker-controlled request header and is not adequately restricted to safe file types, and the plugin...
CVE-2026-111190
The ARForms plugin for WordPress (versions up to and including 7.2.4 ) is vulnerable to an unauthenticated arbitrary file upload via its form file-upload handler. The root cause is that the plugin retrieves the stored filename from an attacker-controlled request header without sufficient restrict...
CVE-2026-12427 ARforms <= 7.2.4 - Unauthenticated Stored Cross-Site Scripting via 'description' Parameter
The ARforms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'description' parameter in all versions up to, and including, 7.2.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web script...
EUVD-2026-123271
The ARforms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'description' parameter in all versions up to, and including, 7.2.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web script...
CVE-2026-12424 ARforms <= 7.2.4 - Unauthenticated Stored Cross-Site Scripting via Referer Header
The ARforms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Referer Header in all versions up to, and including, 7.2.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages th...
CVE-2026-12427
The ARforms plugin for WordPress (versions ≤ 7.2.4 ) is vulnerable to Unauthenticated Stored Cross-Site Scripting (XSS) . The flaw exists in the 'description' parameter due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary web scripts that ex...
EUVD-2026-123270
The ARforms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Referer Header in all versions up to, and including, 7.2.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages th...
CVE-2026-12424
The ARforms plugin for WordPress (all versions up to and including 7.2.4 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping within the arf_save_incomplete_form_data() AJAX handler. Because this handler is registered with wp...
WordPress ARForms plugin <= 7.2.4 - Unauthenticated Arbitrary File Upload to Remote Code Execution via X-FILENAME Header vulnerability
Unauthenticated Arbitrary File Upload to Remote Code Execution via X-FILENAME Header vulnerability discovered by LionTree in WordPress Plugin ARForms versions = 7.2.4...
WordPress ARforms plugin <= 7.2.4 - Unauthenticated Stored Cross-Site Scripting via Referer Header vulnerability
Unauthenticated Stored Cross-Site Scripting via Referer Header vulnerability discovered by Huynh Pham Thanh Luc - Noventiq Vietnam in WordPress Plugin ARForms versions = 7.2.4...
WordPress ARforms plugin <= 7.2.4 - Unauthenticated Stored Cross-Site Scripting via 'description' Parameter vulnerability
Unauthenticated Stored Cross-Site Scripting via 'description' Parameter vulnerability discovered by Huynh Pham Thanh Luc - Noventiq Vietnam in WordPress Plugin ARForms versions = 7.2.4...
CVE-2026-39766
Unauthenticated Cross Site Scripting XSS in ARForms = 7.1.2 versions...
CVE-2026-39766 WordPress ARForms plugin <= 7.1.2 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in ARForms = 7.1.2 versions...