Plugin icon

ARForms - Premium WordPress Form Builder Plugin

arforms

Vulnerabilities:

19

Last Updated:

October 27, 2026

Active Installs:

n/a

Published
Title
Fixed in
CVSS
Published
2026-11-10
Title
ARForms < 7.3 - Unauthenticated Arbitrary File Upload to Remote Code Execution via X-FILENAME Header
Fixed in
Fixed in 7.3
CVSS
8.1 (high)
Published
2026-11-10
Title
ARforms < 7.3 - Unauthenticated Stored Cross-Site Scripting via Referer Header
Fixed in
Fixed in 7.3
CVSS
7.2 (high)
Published
2026-11-10
Title
ARforms < 7.3 - Unauthenticated Stored Cross-Site Scripting via 'description' Parameter
Fixed in
Fixed in 7.3
CVSS
7.2 (high)
Published
2026-10-05
Title
ARforms <= 7.1.2 - Unauthenticated Stored Cross-Site Scripting
Fixed in
No known fix
CVSS
7.2 (high)
Published
2026-07-22
Title
ARforms < 7.2.2 - Unauthenticated Stored Cross-Site Scripting via 'password' Field Values
Fixed in
Fixed in 7.2.2
CVSS
7.2 (high)
Published
2026-06-29
Title
ARforms < 7.2 - Reflected Cross-Site Scripting
Fixed in
Fixed in 7.2
CVSS
6.1 (medium)
Published
2026-06-23
Title
ARForms < 7.1.2 - Unauthenticated Stored Cross-Site Scripting via 'value' Parameter
Fixed in
Fixed in 7.1.2
CVSS
7.2 (high)
Published
2024-12-02
Title
ARForms < 7.0.2 - Subscriber+ Plugin Settings Change
Fixed in
Fixed in 7.0.2
CVSS
5.4 (medium)
Published
2024-12-02
Title
ARForms < 7.0.2 - Subscriber+ Arbitrary File Read via Traversal
Fixed in
Fixed in 7.0.2
CVSS
7.7 (high)
Published
2024-05-22
Title
Arforms < 6.4.1 - Reflected XSS
Fixed in
Fixed in 6.4.1
CVSS
7.1 (high)
Published
2024-05-17
Title
ArForms < 6.6 - Unauthenticated RCE
Fixed in
Fixed in 6.6
CVSS
9.8 (critical)
Published
2024-05-17
Title
ArForms < 6.6 - Admin+ Stored XSS
Fixed in
Fixed in 6.6
CVSS
3.5 (low)
Published
2024-04-22
Title
ARForms < 6.4.1 - Missing Authorization to Arbitrary File Deletion
Fixed in
Fixed in 6.4.1
CVSS
8.1 (high)
Published
2024-04-22
Title
ARforms < 6.4.1 - Authenticated (Subscriber+) SQL Injection
Fixed in
Fixed in 6.4.1
CVSS
8.8 (high)
Published
2024-04-22
Title
ARForms < 6.4.1 - Missing Authorization to Arbitrary Plugin Activation/Deactivation
Fixed in
Fixed in 6.4.1
CVSS
4.3 (medium)
Published
2024-04-22
Title
ARForms < 6.4.1 - Missing Authorization to Arbitrary Option Deletion
Fixed in
Fixed in 6.4.1
CVSS
4.3 (medium)
Published
2024-04-22
Title
ARforms < 6.4.1 - Reflected Cross-Site Scripting
Fixed in
Fixed in 6.4.1
CVSS
6.1 (medium)
Published
2019-10-11
Title
ArForms < 4.0 - Unauthenticated Arbitrary File Deletion via Traversal
Fixed in
Fixed in 4.0
CVSS
8.2 (high)
Published
2018-10-27
Title
ARForms < 3.5.2 - Unauthenticated Arbitrary File Deletion
Fixed in
Fixed in 3.5.2
CVSS
8.2 (high)