ArForms < 6.6 - Remote Code Execution

The ARForms - Premium WordPress Form Builder Plugin WordPress plugin before 6.6 allows unauthenticated users to modify uploaded files in such a way that PHP code can be uploaded when an upload file input is included on a form id: CVE-2024-4620 info: name: ArForms 6.6 - Remote Code Execution autho...

CVE-2026-39766

Unauthenticated Cross Site Scripting XSS in ARForms = 7.1.2 versions...

CVE-2026-39766 WordPress ARForms plugin <= 7.1.2 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in ARForms = 7.1.2 versions...

EUVD-2026-93273

Unauthenticated Cross Site Scripting XSS in ARForms = 7.1.2 versions...

CVE-2026-39766 WordPress ARForms plugin <= 7.1.2 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in ARForms = 7.1.2 versions...

CVE-2026-39766

The ARForms WordPress plugin versions

CVE-2026-39766: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in ARForms = 7.1.2 versions...

PT-2026-106438

Name of the Vulnerable Software and Affected Versions ARForms versions prior to 7.1.3 Description Unauthenticated Cross Site Scripting XSS allows an attacker to execute malicious scripts in the browser of a user without requiring authentication. Recommendations Update to a version newer than 7.1....

WordPress ARForms plugin <= 7.1.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Jamaal ahmed in WordPress Plugin ARForms versions = 7.1.2...

WordPress Contact Form, Survey, Quiz & Popup Form Builder - ARForms plugin <= 1.8.5 - Unauthenticated PHP Object Injection vulnerability

WordPress Contact Form, Survey, Quiz & Popup Form Builder - ARForms plugin = 1.8.5 - Unauthenticated PHP Object Injection vulnerability discovered by Krzysztof Zając - CERT PL in WordPress Plugin ARForms Form Builder versions = 1.8.5...

CVE-2024-13784

The Contact Form, Survey, Quiz & Popup Form Builder – ARForms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.8.5 via deserialization of untrusted input from form submissions. This makes it possible for unauthenticated attackers to inject a PHP...

CVE-2024-13784 Contact Form, Survey, Quiz & Popup Form Builder – ARForms <= 1.8.5 - Unauthenticated PHP Object Injection

The Contact Form, Survey, Quiz & Popup Form Builder – ARForms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.8.5 via deserialization of untrusted input from form submissions. This makes it possible for unauthenticated attackers to inject a PHP...

EUVD-2024-55720

The Contact Form, Survey, Quiz & Popup Form Builder – ARForms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.8.5 via deserialization of untrusted input from form submissions. This makes it possible for unauthenticated attackers to inject a PHP...

CVE-2024-13784

The Contact Form, Survey, Quiz & Popup Form Builder – ARForms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.8.5 via deserialization of untrusted input from form submissions. This makes it possible for unauthenticated attackers to inject a PHP...

CVE-2024-13784

The CVE-2024-13784 entry concerns the WordPress plugin ARForms (Contact Form, Survey, Quiz & Popup Form Builder). Affected versions: all up to and including 1.8.5. Root cause: PHP Object Injection via deserialization of untrusted input from form submissions. Impact requires that a POP chain exist...

CVE-2024-13784 Contact Form, Survey, Quiz & Popup Form Builder – ARForms <= 1.8.5 - Unauthenticated PHP Object Injection

The Contact Form, Survey, Quiz & Popup Form Builder – ARForms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.8.5 via deserialization of untrusted input from form submissions. This makes it possible for unauthenticated attackers to inject a PHP...

CVE-2024-13784: Deserialization of Untrusted Data

The Contact Form, Survey, Quiz & Popup Form Builder – ARForms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.8.5 via deserialization of untrusted input from form submissions. This makes it possible for unauthenticated attackers to inject a PHP...

PT-2026-73139

Name of the Vulnerable Software and Affected Versions ARForms versions prior to 1.8.6 Description The ARForms plugin for WordPress is susceptible to PHP Object Injection due to the deserialization of untrusted input received from form submissions. This allows unauthenticated attackers to inject a...

WordPress Plugin Arforms Listing Detection

Searches for sensitive directories present in the arforms plugin. !/usr/bin/env python3 -- coding: utf-8 -- """Searches for sensitive directories present in the arforms plugin.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info =...

WordPress ARforms plugin <= 7.2.1 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Luc Huynh from Noventiq RedTeam - Noventiq Vietnam in WordPress Plugin ARForms versions = 7.2.1...