CVE-2024-4620

The ARForms - Premium WordPress Form Builder Plugin (versions prior to 6.6 ) is vulnerable to unauthenticated Remote Code Execution (RCE) . The flaw allows unauthenticated users to modify uploaded files in a manner that enables the upload of malicious PHP code whenever an upload file input is inc...

CVE-2019-16902

CVE-2019-16902 – ARforms WordPress plugin : The ARforms plugin 3.7.1 is vulnerable due to arf_delete_file in arformcontroller.php, which allows an unauthenticated attacker to delete arbitrary files by supplying the full pathname. This impacts WordPress installations using ARforms 3.7.1. Public ex...

CVE-2024-4621

The ARForms - Premium WordPress Form Builder Plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in versions prior to 6.6 . The root cause is the failure to properly sanitise and escape certain plugin settings. This flaw allows high-privilege users, such as administrators, to ...

CVE-2024-32705

The reputeinfosystems ARForms WordPress plugin (versions

CVE-2024-32702

The ARForms WordPress plugin (versions

CVE-2024-54217

CVE-2024-54217 describes a Missing Authorization vulnerability in the WordPress plugin ARForms by Repute Info Systems, affecting ARForms versions from n/a up to and including 6.4.1. The connected sources confirm the issue is related to unauthorized changes to the plugin settings (“Plugin Settings...

CVE-2024-32706

The ARForms WordPress plugin (versions

CVE-2024-54216

CVE-2024-54216 describes a path traversal path traversal vulnerability in ARForms (Repute InfoSystems) affecting ARForms versions up to 6.4.1. The issue enables Arbitrary File Read via a directory-traversal vector (".../...//"). Public sources in the connected documents indicate the vulnerability...

CVE-2024-32704

The reputeinfosystems ARForms WordPress plugin is affected by a Missing Authorization vulnerability (CVE-2024-32704) in versions 6.4 and earlier . This flaw allows users with Subscriber privileges to perform Arbitrary WordPress Options Removal , which falls under the OWASP Top 10 A1: Broken Acces...

CVE-2024-32703

The ARForms WordPress plugin (versions

CVE-2024-0427

The ARForms - Premium WordPress Form Builder Plugin for WordPress, in versions before 6.4.1 , is vulnerable to Reflected Cross-Site Scripting (XSS) . The root cause is the improper escaping of user-controlled input when reflected in specific AJAX actions . This allows an attacker to execute malic...

CVE-2024-10504

The Contact Form, Survey, Quiz & Popup Form Builder WordPress plugin, in versions prior to 1.7.1 , is vulnerable to an unauthenticated Stored Cross-Site Scripting (XSS) attack. The root cause is the failure to properly sanitise and escape certain parameters when they are outputted on a page. This...