CVE-2026-3652: ARForms <= 7.1.3 - Unauthenticated Stored Cross-Site Scripting via 'value' Parameter
The ARForms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the value parameter of the arfsaveincompleteformdata AJAX action in all versions up to, and including, 7.1.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that will execute whenever an administrator views the "Partial Filled Form Entries" page in the ARForms dashboard.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-3652?
CVE-2026-3652 has a high severity rating of 7.2.
What security risk does CVE-2026-3652 pose?
CVE-2026-3652 poses a Stored Cross-Site Scripting risk due to insufficient input sanitization.
How can I fix CVE-2026-3652?
To fix CVE-2026-3652, update the ARForms plugin to the latest version beyond 7.1.3.
What versions of ARForms are affected by CVE-2026-3652?
All versions of ARForms up to and including 7.1.3 are affected by CVE-2026-3652.
Is CVE-2026-3652 exploitable by unauthenticated users?
Yes, CVE-2026-3652 can be exploited by unauthenticated users via the 'value' parameter.