CVE-2026-39766: WordPress ARForms plugin <= 7.1.2 - Cross Site Scripting (XSS) vulnerability

Q: Does exploitation require an authenticated WordPress account?

No. The vulnerability is unauthenticated, so an attacker does not need WordPress credentials to attempt exploitation.

Q: Does an attacker need a victim to take action?

Yes. The CVSS vector indicates user interaction is required, meaning exploitation depends on a user interacting with attacker-controlled content or a request.

Q: How can I determine whether my site is affected?

Check the installed ARForms version. Versions 7.1.2 and earlier are identified as affected.

Published Oct 6, 2026

Updated

Unauthenticated Cross Site Scripting (XSS) in ARForms <= 7.1.2 versions.

Affected Software

1 affected component

ARForms ARForms<=7.1.2

Event History

Oct 6, 2026

CVE Published

via MITRE·08:34 AM

Data Sourced

via MITRE·08:34 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·09:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Does exploitation require an authenticated WordPress account?

No. The vulnerability is unauthenticated, so an attacker does not need WordPress credentials to attempt exploitation.

Does an attacker need a victim to take action?

Yes. The CVSS vector indicates user interaction is required, meaning exploitation depends on a user interacting with attacker-controlled content or a request.

How can I determine whether my site is affected?