CVE-2026-3652

Name of the Vulnerable Software and Affected Versions ARForms versions prior to 7.1.4

Description Insufficient input sanitization and output escaping in the ARForms plugin allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS). By exploiting the value parameter of the arf save incomplete form data AJAX action, an attacker can inject arbitrary web scripts. These scripts execute when an administrator accesses the Partial Filled Form Entries page within the dashboard.

Recommendations Update ARForms to version 7.1.4 or later. As a temporary mitigation, restrict access to the arf save incomplete form data AJAX action or avoid using the value parameter until the update is applied.