ARForms: Unauthenticated stored Cross-Site Scripting via Referer header
Summary
The ARForms plugin for WordPress up to and including 7.2.4 contains a stored Cross-Site Scripting flaw in the handling of the Referer header by the arf_save_incomplete_form_data() AJAX handler. The handler is reachable without authentication, so an unauthenticated attacker can store a script by submitting a partial form entry with a forged Referer header. The script runs in the browser of anyone who views the injected page, including administrators in the back end, which can enable session theft or actions in their name. The CNA scores the issue CVSS 7.2 (High), while VulDB rates it 4.3 (Medium).
Affected
- ARForms WordPress plugin, all versions up to and including 7.2.4
- VulDB lists 7.2.0 through 7.2.4; older branches should be treated as affected
Fixed in
Unknown. No fixed version has been confirmed. The vendor changelog entries up to 7.3 (7 November 2026) describe only minor bug fixes and do not mention this issue.
Workaround
- No vendor-confirmed workaround.
- Deactivate ARForms on sites where it is not business-critical.
- If the plugin must stay active, restrict who can reach the form submission path and review stored form entries, especially those opened in the back end.
Exploitation
- Not known to be exploited in the wild, and not listed in the KEV catalogue.
- No public proof of concept found as of 10 November 2026; this does not prove that none exists.
- No login is needed to plant the payload, but a user must view the injected page.
Our recommendation
- Check whether ARForms is installed on public websites and deactivate it where it is not needed.
- If it must stay active, restrict access to the form submission path and monitor the back end for suspicious form entries.
- Update promptly once the vendor publishes a fixed version, and monitor the vendor changelog and the Wordfence record for it.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Wordfence threat intelligence record www.wordfence.com
- ARForms vendor changelog www.arformsplugin.com
- VulDB CVE-2026-12424 vuldb.com
- OpenCVE CVE-2026-12424 app.opencve.io
- OffSeq radar CVE-2026-12424 radar.offseq.com
- WPScan ARForms plugin wpscan.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 09:23.
Original description (NVD)
The ARforms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Referer Header in all versions up to, and including, 7.2.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The arf_save_incomplete_form_data() AJAX handler is registered with wp_ajax_nopriv_, meaning unauthenticated attackers can store a malicious payload by submitting a partial form entry with a forged Referer header, with no authentication required at any step.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.