CVE-2026-12424: ARforms <= 7.2.4 - Unauthenticated Stored Cross-Site Scripting via Referer Header
The ARforms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Referer Header in all versions up to, and including, 7.2.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The arfsaveincompleteformdata() AJAX handler is registered with wpajaxnopriv, meaning unauthenticated attackers can store a malicious payload by submitting a partial form entry with a forged Referer header, with no authentication required at any step.
Affected Software
Event History
Frequently Asked Questions
Which installations are exposed?
WordPress sites using the ARforms plugin in versions up to and including 7.2.4 are affected. The vulnerable AJAX handler is available to unauthenticated users.
What does an attacker need to exploit this issue?
An attacker needs to submit a partial form entry to the arf_save_incomplete_form_data() AJAX handler and provide a forged Referer header containing a script payload. No account, privileges, or user interaction are required to store the payload.
When does the injected script execute?
The stored script executes when a user accesses a page containing the injected content. The provided data does not identify which user roles or specific pages are most likely to view it.