Plugin icon

ARForms - Premium WordPress Form Builder Plugin

arforms

Vulnerabilities:

12

Last Updated:

June 20, 2026

Active Installs:

n/a

Published
Title
Fixed in
CVSS
Published
2024-12-02
Title
ARForms <= 6.4.1 - Missing Authorization to Plugin Settings Change
Fixed in
No known fix
CVSS
5.4 (medium)
Published
2024-12-02
Title
ARForms <= 6.4.1 - Directory Traversal to Authenticated (Subscriber+) Arbitrary File Read
Fixed in
No known fix
CVSS
7.7 (high)
Published
2024-05-22
Title
Arforms < 6.4.1 - Reflected XSS
Fixed in
Fixed in 6.4.1
CVSS
7.1 (high)
Published
2024-05-17
Title
ArForms < 6.6 - Admin+ Stored XSS
Fixed in
Fixed in 6.6
CVSS
3.5 (low)
Published
2024-05-17
Title
ArForms < 6.6 - Unauthenticated RCE
Fixed in
Fixed in 6.6
CVSS
9.8 (critical)
Published
2024-04-22
Title
ARforms < 6.4.1 - Authenticated (Subscriber+) SQL Injection
Fixed in
Fixed in 6.4.1
CVSS
8.8 (high)
Published
2024-04-22
Title
ARForms < 6.4.1 - Missing Authorization to Arbitrary Plugin Activation/Deactivation
Fixed in
Fixed in 6.4.1
CVSS
4.3 (medium)
Published
2024-04-22
Title
ARForms < 6.4.1 - Missing Authorization to Arbitrary Option Deletion
Fixed in
Fixed in 6.4.1
CVSS
4.3 (medium)
Published
2024-04-22
Title
ARforms < 6.4.1 - Reflected Cross-Site Scripting
Fixed in
Fixed in 6.4.1
CVSS
6.1 (medium)
Published
2024-04-22
Title
ARForms < 6.4.1 - Missing Authorization to Arbitrary File Deletion
Fixed in
Fixed in 6.4.1
CVSS
8.1 (high)
Published
2019-10-11
Title
ArForms < 4.0 - Unauthenticated Arbitrary File Deletion via Traversal
Fixed in
Fixed in 4.0
CVSS
8.2 (high)
Published
2018-10-27
Title
ARForms < 3.5.2 - Unauthenticated Arbitrary File Deletion
Fixed in
Fixed in 3.5.2
CVSS
8.2 (high)