CVE-2026-12421

The ARforms WordPress plugin (affected: all versions up to and including 7.2.1) is vulnerable to Stored Cross-Site Scripting via password field values due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts into pages that ...