HIGHVulnerability
Verified
Global

NVD HIGH: CVE-2026-3652 — The ARForms plugin for WordPress is vulnerable to Stored Cross-Site Scripting vi...

·Source: NIST NVD

Updated:

Executive Summary

The ARForms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `value` parameter of the `arf_save_incomplete_form_data` AJAX action in all versions up to, and including, 7.1.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that will execute whenever an administrator views the "P

Analysis

The ARForms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `value` parameter of the `arf_save_incomplete_form_data` AJAX action in all versions up to, and including, 7.1.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that will execute whenever an administrator views the "Partial Filled Form Entries" page in the ARForms dashboard. CVSS Score: 7.2. Published: 2026-06-24T04:17:06.923.

Indicators of Compromise (1)

CVE (1)
CVE-2026-3652
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Jun 24, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerabilityNEW

The Payments Association names Renuka Rawlins director of policy and government affairs

The Payments Association, a trade body for the payments sector, has appointed Renuka Rawlins as its new Director of Policy & Government Affairs.

Finextra
MEDIUMVulnerabilityNEW

Azure CLI Password Spray Hits at Least 78 Microsoft Accounts in 81M+ Attempts

Cybersecurity researchers have warned of a "massive, ongoing, automated password spray attack" aimed at Microsoft's Azure command-line interface (CLI), compromising dozens of accounts in the process. The activity, per Huntress, originates from an IPv6 address range (2a0a:d683::/32) controlled by internet infrastructure provider LSHIY LLC (AS32167). "Between June 12 and June 26, the threat

The Hacker News
CRITICALVulnerability

NVD CRITICAL: CVE-2026-6070 — The WP-BusinessDirectory plugin for WordPress is vulnerable to Unauthenticated A...

The WP-BusinessDirectory plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Deletion in versions up to and including 4.0.1. This is due to insufficient path validation in the remove() method of the JBusinessDirectoryControllerUpload class. The task=upload.remove endpoint is accessible without authentication via the plugin's frontend routing system. The _filename parameter is acce

CVE-2026-6070
NIST NVD