Executive brief
ARForms is a popular WordPress plugin used to create and manage complex forms on websites. A security flaw allows unauthenticated visitors to inject malicious scripts into the site's database by submitting incomplete form data. These scripts are then triggered when a site administrator views the partial entries in the dashboard, potentially leading to unauthorized administrative actions or account takeover.
Technical details
The vulnerability is classified as Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping on the 'value' parameter within the 'arf_save_incomplete_form_data' AJAX action. An unauthenticated attacker can send a crafted AJAX request to the WordPress site, storing malicious JavaScript in the database. The payload is executed in the context of an administrative user when they navigate to the "Partial Filled Form Entries" page in the ARForms dashboard. This can lead to session hijacking or the creation of unauthorized administrative accounts. The issue affects all versions of the plugin up to and including 7.1.3.
Affected products
- Repute InfoSystems ARForms up to, and including, 7.1.3
Timeline
- 2026-06-24: disclosed
- 2026-06-24: advisory