WordPress plugin
ARforms security & vulnerabilities
Unpatched vulnerability in the latest version
At least one vulnerability affects the latest version and no fix has been released. Deactivate the plugin or restrict access to the affected feature until the vendor ships a patch.
- Critical1
- High11
- Medium7
- Low0
All ARforms vulnerabilities
- High8.1Unauthenticated Arbitrary File Upload to Remote Code Execution via X-FILENAME Header
≤7.2.4Update to 7.3
- High7.2Unauthenticated Stored Cross-Site Scripting via Referer Header
≤7.2.4Update to 7.3
- High7.2Unauthenticated Stored Cross-Site Scripting via 'description' Parameter
≤7.2.4Update to 7.3
- High7.2Unauthenticated Stored Cross-Site Scripting
≤7.1.2No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting via 'password' Field Values
≤7.2.1Update to 7.2.2
- Medium6.1Reflected Cross-Site Scripting
≤7.1.2Update to 7.2
- High7.2Unauthenticated Stored Cross-Site Scripting via 'value' Parameter
≤7.1.1Update to 7.1.2
- Medium5.4Missing Authorization to Plugin Settings Change
≤6.4.1No patch available
- High7.7Directory Traversal to Authenticated (Subscriber+) Arbitrary File Read
≤6.4.1No patch available
- Medium6.1Premium WordPress Form Builder <= 6.4.0 - Reflected Cross-Site Scripting
≤6.4.0Update to 6.4.1
- Critical10.0Unauthenticated Arbitrary File Upload
≤6.5Update to 6.6
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
≤6.5Update to 6.6
- Medium4.3Missing Authorization to Arbitrary Plugin Activation/Deactivation
≤6.4Update to 6.4.1
- High8.1Missing Authorization to Arbitrary File Deletion
≤6.4Update to 6.4.1
- Medium4.3Missing Authorization to Arbitrary Option Deletion
≤6.4Update to 6.4.1
- High8.8Authenticated (Subscriber+) SQL Injection
≤6.4Update to 6.4.1
- Medium6.1Reflected Cross-Site Scripting
≤6.4Update to 6.4.1
- High7.5Unauthenticated Arbitrary File Deletion
≤3.7.1Update to 4.0
- High7.5Unauthenticated Arbitrary File Deletion via Path Traversal
<3.5.2Update to 3.5.2
ARforms: common questions
Does ARforms have known vulnerabilities?
Yes. VulnCrest Radar lists 19 known vulnerabilities in ARforms: 1 critical, 11 high, 7 medium. At least one is not fixed in the latest version.
How do I check which version of ARforms I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent ARforms vulnerability?
CVE-2026-111190, published Nov 10, 2026: ARForms <= 7.2.4 - Unauthenticated Arbitrary File Upload to Remote Code Execution via X-FILENAME Header. Severity: High (CVSS 8.1).
Is any ARforms vulnerability listed in CISA KEV?
No. None of the known ARforms vulnerabilities is currently listed in the CISA KEV catalog.